Also see Searching journal data.
Follow the steps to activate journaling on a specific file.
Then use the following command to take a look at the file tracking information:
You will see several different forms of tracking information displayed. Each time the file is opened, closed, read and updated, an entry will be inserted. The first few entries just track the fact that journaling has been started for the file. After those, you will see the results of the testing transactions that you performed.
To review file changes, look for the audit records with type codes "UB" and "UP". The UB record shows you a record image BEFORE an update was posted and the UP record shows the record image AFTER an update was posted.
Here is a UB (before update) record:
And the same record after the update (UP):
As always with IBM i journals, the actual information contained in the record is difficult to decipher.
Finding "UB" and "UP" in IBM i SQL services
Use a DISPLAY_JOURNAL query like this to locate journal entries of this type:
SELECT * FROM TABLE (QSYS2.DISPLAY_JOURNAL('*library*', '*journal*')) AS JT
One before/after transaction on one screen in our iFileAudit product:
As seen in the web UI version of iFileAudit:
BROWSE KISCO U