Save and delete audit journal receivers

This article describes how to save and delete audit journal receivers, explains why it is important, and provides step-by-step instructions.

Purpose:

To attach a new audit journal receiver; to save and delete the old receiver

How to:

CHGJRN QSYS/QAUDJRN
JRNRCV(*GEN) SAVOBJ (to save old receiver)
DLTJRNRCV (to delete old receiver)

Authority:

*ALL authority to journal receiver; *USE authority to journal

Note: Select a time when the system is not busy to save and delete audit journal receivers.

You should regularly detach the current audit journal receiver and attach a new one for two reasons:

Analyzing journal entries is easier if each journal receiver contains the entries for a specific, manageable time period.
Large journal receivers can affect system performance, in addition to taking valuable space on auxiliary storage.

Having the system manage receivers automatically is the recommended approach. You can specify this by using the Manage receiver parameter when you create the journal.

If you have set up action auditing and object auditing to log many different events, you may need to specify a large threshold value for the journal receiver. If you are managing receivers manually, you may need to change journal receivers daily. If you log only a few events, you may want to change receivers to correspond with the backup schedule for the library containing the journal receiver.

You use the CHGJRN command to detach a receiver and attach a new receiver.

System-Managed Journal Receivers: If you have the system manage the receivers, use the following procedure to save all detached QAUDJRN receivers and to delete them:

Type WRKJRNA QAUDJRN. The display shows you the currently attached receiver. Do not save or delete this receiver.
Use F15 to work with the receiver directory. This shows all receivers that have been associated with the journal and their status.
Use the SAVOBJ command to save each receiver, except the currently attached receiver, which has not already been saved.
Use the DLTJRNRCV command to delete each receiver after it is saved.

Note: An alternative to the above procedure could be done using the journal message queue and monitoring for the CPF7020 message which indicates that the system change journal has completed successfully.

For additional information, refer to the section: Backup and recovery.