Interpreting Journal Data
The IBM i journaling feature provides a great built-in data audit benefit, but it is not easy to interpret the data! For example, the ENTRY_DATA value for selected entry might look like this:
E2C1E5404040404040F0F8F2F9F2F3F1F7F0F1F5F1F1
C6C9D3C1E4C440404040D2C9E2C3D6F1C2D2E4D75CD5
D640404040404040F0F8F2F9F2F3F1F7F0F1F5F1C9C6
C1D1D9D5F3F1F9F4C6C9D3C1E4C4D1D9D54040404040
40404040404040404040404040404040F0F0F0F0F0F0
F0F0F0F800000000000000000000000000000000F0F0
F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F0F85CE2E8E2
C2C1E2404040
Learning to decode journal entries can be time consuming and challenging.
Other, more helpful, data points can help you figure out what is going on:
The IBM DISPLAY_JOURNAL documentation does a good job of explaining the codes and other details.
Using DSPJRN
When it's time to search for a specific activity in this journal history, the DSPJRN command leaves a lot to be desired. To give you a better way to look at before/after data changes, you can transfer the DSPJRN information into a database file and then use your favorite database tool to create more usable information.
To create the database for your query tool, run the following form of the DSPJRN command:
DSPJRN JRN(MYLIB/CUSTMSTR) OUTPUT(*OUTFILE) +
OUTFILFMT(*TYPE4) OUTFILE(MYLIB/CUSTMSTRJ)
In this sample, the database version of the Journal now resides in the database file named CUSTMSTRJ. Use your query tool to select records with type codes UB and UP (the field name to select on is JOENTT). If your database file record length is exceptionally long, you may have to parse the record data information to get at what you are looking for, but the report generated should point you to all of the record changes posted to the file and you should be able to sort out who did what and when they did it.
Using DISPLAY_JOURNAL in IBM i SQL Services
The DISPLAY_TABLE function in QSYS2 can filter and return journal entries. See the IBM documentation link at the top of the page. It includes sample queries for searching journal entries. Here is a basic query:
SELECT * FROM TABLE (QSYS2.DISPLAY_JOURNAL('*library*', '*journal*')) AS JT;
As you can see, the results are still need to interpreted for human understanding.
Start building a WHERE clause to look for specific entries. In this case, all journal entries for a specific user:
SELECT * FROM TABLE (QSYS2.DISPLAY_JOURNAL('*library*', '*journal*')) AS JT WHERE "CURRENT_USER" = '*username*';
