I looked through the journal entry descriptions in the audit journal, but I didn't see anything approaching this. Short of trying to modify the system commands so that a program writes the action to a log first, is there a way to capture this stuff?
Commands will then be logged in the Audit Journal. If you don't currently have an Audit Journal, instructions for setting one up are here:
Display the Audit Journal entries with Entry Type "CD" to view the commands. You can view these entries manually with the command DSPJRNJRN(QSYS/QAUDJRN) JRNCDE((T)) ENTTYP(CD) or you can display them to an outfile and run a query against it. You can quickly and easily find the ADDLIBLE/RMVLIBLE/CHGLIBL commands in the outfile using SQL:
STRSQL then select * from Library/Outfile where JOESD like '%ADDLIBLE%' or JOESD like '%RMVLIBLE%' or JOESD like '%CHGLIBL%'For additional help with the Audit Journal, see Chapter 9 and Appendix F of the iSeries Security Reference, SC41-5302.
This was first published in May 2005