IBM iSeries : fulls details of journal entries (type R)

Question

I need to analyze the journal entries of type R for DB2 on iSeries in order to be able to audit all sql requests (Insert, Update,Delete) generating changes on data : in fact, i would like to analyze the ENTRY_DATA field as returned by QSYS2.Display_Journal in order to dissect image-before / image after of changed lines.

I can't find the appropriate IBM doc / web url providing all details on those entries. Can somebody point me to such details ?

Answer 1

Starting point for journal info is here: Journal entry information

Note that while Display_Journal() is nice, it may not be all that useful for your purposes as it returns the before and after image of the record as a BLOB. Each ENTRY_DATA format would be unique to the file being journaled. Plus, there isn't for instance a built in way to convert a substring of the blob back into a readable packed decimal value.

The Journal APIs would probably be a better choice.

But a generic audit tool that uses the journals is a non-trivial task.

Best choice would be to simply buy a third party tool designed to do what you're trying to do.

Answer 2

Extract before/after image from journal.

Simply copy the joesd to a flat file. Then copy flat file to database *NOCHK

This code gets the after image.

? DSPJRN ?*JRN(mylib/myJRN)
           OUTPUT(*OUTFILE) 
           OUTFILFMT(*TYPE3)
           OUTFILE(QTEMP/Z1)
           ENTDTALEN(*CALC)

insert into myflatfil
SELECT joesd FROM qtemp/z1 WHERE JOENTT = 'UP'

cpyf myflatfil mydatabase *nochk

Answer 3

Export Journal Entries V4.9

The EXPJRNE command exports journal entries of fiels, data areas and data queues to an output file. The output file has the same layout as the journalized file plus the journaling information. EXPJRNE makes it really easy to analyze journal entries by SQL.

EXPJRNE