Informing the IBM Community

“Where did this print come from? How I learned to love the audit journal”



A question that crops up from time to time since the paperless office never materialised. Another variation is ‘I asked for a print but didn’t get it, where did it go?’

This is one of the first things that got me to look in detail at the audit functionality on IBMi, maybe not the traditional introduction to it I know but whatever works. Particularly given the CPYAUDJRNE command that came in under V5R4 this is an excellent way to drag out the who/what/where/when that customers often ask for.

There are also a number of third party products you can get which will help with audit journal extract/analysis but I’m going to be sticking with CPYAUDJRNE for my example as it’s the shipped solution.

The first thing to bear in mind is this assumes you’re using the audit journal to begin with (system value QAUDCTL.) Along with auditing *SPLFDTA and/or *PRTDTA at either system level (QAUDLVL(2)), or if you prefer, on a per user basis.

For our example I’m going to be looking for a sales order print 01-12345 that should’ve been printed 28th February 2019 at Midday.

First off I want to make sure I have some records:

This will give me all records for the day, in theory I could narrow by time but given the print is MIA let’s check before/after as well.

The advantage of using the PO is that it includes the userdata of the print, so going back to my example the spoolfile is set to stamp the order number into the userdata so I can easily search for that (POUDTA = ’01-12345′) This will also give me information on who/what created the print (POJNAM/POJUSR/POUSRP) if I need to trace it back, along with confirming whether the print was sent to a remote system or printed directly (POETYP.)

Assuming the userdata isn’t helping, or a record isn’t on PO you can still try to find what happened to your print with the SF output. This is also useful if you’re trying to check the entire history of your print rather than just the fact it was spat out the other end.

Since you don’t have the userdata you’ll be looking for a “good match” by other information you have such as user/spoolname/date/time (SFSJOB/SFSUSR/SFSNAM/SFOCDAT/SFOCTIM). Assuming you’ve already found your print under PO and now just want its full history you could do a full match via spool file number (SFSNUM or SFLNBR) & creation date/time.

The above is also a great one I keep in my pocket for when I get the call “our printer stopped working, but the writer kept going, can you tell us what prints we missed?” I can get a list of userdata from QAUDITPO and give my customer the list of what they need to reprint.

Likewise if you get “the IBM box didn’t produce the print” this can be investigated through the above to confirm print production (SF) and printing (PO).

How useful was this post?

Click on a star to rate it!

Average rating 0 / 5. Vote count: 0

No votes so far! Be the first to rate this post.