I looked through the journal entry descriptions in the audit journal, but I didn't see anything approaching this. Short of trying to modify the system commands so that a program writes the action to a log first, is there a way to capture this stuff?
Commands will then be logged in the Audit Journal. If you don't currently have an Audit Journal, instructions for setting one up are here:
Display the Audit Journal entries with Entry Type "CD" to view the commands. You can view these entries manually with the command DSPJRNJRN(QSYS/QAUDJRN) JRNCDE((T)) ENTTYP(CD) or you can display them to an outfile and run a query against it. You can quickly and easily find the ADDLIBLE/RMVLIBLE/CHGLIBL commands in the outfile using SQL:
STRSQL then select * from Library/Outfile where JOESD like '%ADDLIBLE%' or JOESD like '%RMVLIBLE%' or JOESD like '%CHGLIBL%'For additional help with the Audit Journal, see Chapter 9 and Appendix F of the iSeries Security Reference, SC41-5302.
Dig Deeper on iSeries system performance and monitoring
Related Q&A from Scott Ingvaldson
When encountering problems using the SNDDST command to send a *LMSG on the iSeries, specify a valid SMTP name in the directory entry of the sender to... Continue Reading
On the AS/400 system, close all sessions in the receiving envrionment when transferring files from one environment to another if the sessions hold ... Continue Reading
After extending storage capacity on an IBM 520, the system performance depends on the workload amount and should not be affected negatively as long ... Continue Reading