Saving and deleting audit journal receivers

Select a time when the system is not busy to save and delete audit journal receivers.

You should regularly detach the current audit journal receiver and attach a new one for two reasons:

• Analyzing journal entries is easier if each journal receiver contains the entries for a specific, manageable time period.

• Large journal receivers can affect system performance, in addition to taking valuable space on auxiliary storage.

Having the system manage receivers automatically is the recommended approach. You can specify this by using the Manage receiver parameter when you create the journal.

If you have set up action auditing and object auditing to log many different events, you may need to specify a large threshold value for the journal receiver. If you are managing receivers manually, you may need to change journal receivers daily. If you log only a few events, you may want to change receivers to correspond with the backup schedule for the library containing the journal receiver.

You use the CHGJRN command to detach a receiver and attach a new receiver.

System-Managed Journal Receivers: If you have the system manage the receivers, use the following procedure to save all detached QAUDJRN receivers and to delete them:

1. Type WRKJRNA QAUDJRN. The display shows you the currently attached receiver. Do not save or delete this receiver.

2. Use F15 to work with the receiver directory. This shows all receivers that have been associated with the journal and their status.

3. Use the SAVOBJ command to save each receiver, except the currently attached receiver, which has not already been saved.

4. Use the DLTJRNRCV command to delete each receiver after it is saved.