IBM i Journals are the Sherlock Holmes of data storage. IBM i Journal keeps a log of events, just like your Diary. Imagine writing down every single thing that happened to you during the day. This is what a journal does for any file on the system.

Me – trying to explain what a journal is, while slurping cold tea at a ridiculously early time in the morning.

If a journal is so clever it must have several moving parts. Before we dive into the nitty-gritty lets looks at the components of a Journal:

• Journal: The main object that records activities.
• Journal Entries: Records of changes made to objects, such as database updates, file opens, and closes.
• Journal Receiver: An object where journal entries are stored.

Journaling is essential for transaction logging, data recovery, and auditing.

What is a Journal?

Journals track and record changes to objects on the IBM i system: A journal quietly spends its time automatically monitoring any given library/file (or table.schema for those that prefer SQL speak) looking for data updates, additions, deletes and more. It even records things like programs opening the file to read it… and then deciding not to.

Journals are used to maintain data integrity and provide a reliable audit trail. They help in recovering data after an unexpected system failure or other issues.

What is a Journal Entry?

An IBM i journal entry is a record that logs changes made to objects on the IBM i system. These entries are crucial for tracking modifications, ensuring data integrity, and aiding in recovery processes.

• Contents: Each journal entry includes information about the type of change, the data that was changed, the job and user responsible, and the time of the change. It often contains before and after images of the data so you can see an snapshot of the exact update that was performed.
• Types: There are various types of journal entries, each identified by a specific code. These can include changes to database files, object creations, deletions, and other system events.
• Usage: Journal entries help in auditing, troubleshooting, and recovering data after system failures. They provide a detailed history of changes, which is essential for maintaining system integrity.

What is a Journal Receiver?

The receiver is the bucket that the journal stores all the information it has to record within. Think of the Journal as a funnel, filtering and choosing which data to drip into the receiver. This bucket fills up (it can be created with various different sizes, ranging from a little sand castle bucket to something the size of a Jacuzzi tub).

Don’t worry when the receiver gets full, you just roll it out of the way and roll in a new, fresh receiver for the journal to continue filling.

So – one journal can have many journal receivers.

How do I find what an IBM i JOURNAL has been monitoring?

To view what an IBM i journal has been logging, you can use the Display Journal (DSPJRN) command:

Open a Command Line: Access the command line on your IBM i system.

Enter the DSPJRN Command: Type DSPJRN followed by the name of the journal you want to view. For example, if you want to view the audit journal, you would type:

DSPJRN QAUDJRN

Press F4: This will bring up a prompt where you can specify additional parameters, such as the range of entries to display or specific types of entries.

Specify Parameters: You can filter the entries by date, time, or type. For example, you can select entries within a specific date range or only certain types of entries, like incorrect sign-on attempts.

View Entries: After setting your parameters, press Enter to display the journal entries. You will see a list of entries with details such as sequence number, type, and timestamp.

Detailed View: To see more details about a specific entry, you can use option 5 (Display entire entry) on the entry list screen.

There you have it!

I hope this blog of (a) what a Journal is, (b) how it relates to a Receiver and (c) what it can store — makes sense?

They say a picture paints a thousand words so how about I record a quick video of journals in action?

Creating Journals, Receivers and Files in Realtime

Let’s go and create a journal (JRN), a journal receiver (JRNRCV) then create a physical file (PF) then start Journaling on that file (STRJRNPF) and what happens when we do some updates. We can walk through the details and even view the journal entries (JRNE):

What do all those 2 character codes mean for the journal code and type?

The Display Journal display shows a list of the journal entries that you requested to be displayed.

The journal code — This code is set by the system to indicate the kind of journal entry that was deposited. The journal codes and brief descriptions for the journal codes follow:

• A – System accounting entry
• B – Integrated file system operation
• C – Commitment control operation
• D – Database file operation
• E – Data area operation
• F – Database file member operation
• I – Internal operation
• J – Journal or journal receiver operation
• L – License management
• M – Network management data
• P – Performance tuning entry
• Q – Data queue operation
• R – Record level operation
• S – Distributed mail service for SNA distribution services (SNADS), network alerts, or mail server framework
• T – Audit trail entry
• U – User generated
• Y – Library operation

The journal entry type — This code is set by the system to indicate the specific type of journal entry. There are many different types of journal entries that can occur for each journal code.

For journal code A the possible journal entry types are:

• DP – Direct print information
• JB – Job accounting segment
• SP – Spooled print information

For journal code B the possible journal entry types are:

• AA – Change audit attribute
• AJ – Start of apply
• AT – End of apply
• BD – IFS object deleted
• B0 – Begin create
• B1 – Create summary
• B2 – Link to existing object
• B3 – Rename, move object
• B4 – Remove link (parent directory)
• B5 – Remove link (link)
• B6 – Bytes cleared, after-image
• B7 – Created object authority information
• CS – IFS object closed
• ET – End journaling for object
• FA – IFS object attribute changed
• FC – IFS object forced
• FF – Storage for object freed
• FR – IFS object restored
• FS – IFS object saved
• FW – Start of save-while-active
• JA – Change journaled object attribute
• JT – Start journaling for object
• OA – Change object authority
• OF – IFS object opened
• OG – Change primary group
• OI – Object in use at abnormal end
• OO – Change object owner
• RN – Rename file identifier
• TR – IFS object truncated
• WA – Write, after-image

For journal code C the possible journal entry types are:

• BA – Commit block in use at abnormal end
• BC – Commitment control environment begun
• CM – Set of record changes committed
• CN – End Rollback
• DB – Internal entry
• EC – Commitment control environment ended
• LW – Logical unit of work ended
• PC – Prepare commit block
• RB – Set of record changes rolled back
• R1 – Rollback started
• SB – Start save point
• SC – Commit cycle started
• SQ – Release save point
• SU – Rollback save point

For journal code D the possible journal entry types are:

• AC – Add RI constraint
• CG – Change file
• CT – Create database file
• DC – Remove RI constraint
• DD – End of apply or remove
• DF – Delete file
• DG – Start of apply or remove
• DH – File saved
• DJ – Change journaled object attribute
• DT – Delete file
• DW – Start of save
• DZ – File restored
• EF – End journaling for file
• FM – File moved
• FN – File renamed
• GC – Change constraint
• GO – Change owner
• GT – Grant authority
• ID – File in use at abnormal end
• JF – Start journaling for file
• LF – Logical file association
• MA – Member added
• M1 – Create mask
• M2 – Drop mask
• M3 – Alter mask
• P1 – Create permission
• P2 – Drop permission
• P3 – Alter permission
• RV – Revoke authority
• TC – Add trigger
• TD – Remove trigger
• TG – Change trigger
• TQ – Refresh table
• ZB – Object attribute change

For journal code E the possible journal entry types are:

• EA – Update data area, after-image
• EB – Update data area, before-image
• ED – Data area deleted
• EE – Data area created
• EG – Start journal for data area
• EH – End journal for data area
• EI – Data area in use at abnormal end
• EK – Change journaled object attribute
• EL – Data area restored
• EM – Data area moved
• EN – Data area renamed
• EQ – Data area changes applied
• ES – Data area saved
• EU – RMVJRNCHG command started
• EW – Start of save-while-active for data area
• EX – Data area changes removed
• EY – APYJRNCHG command started
• ZA – Change authority
• ZB – Object attribute change
• ZO – Change owner
• ZP – Change primary group
• ZT – Change audit attribute

For journal code F the possible journal entry types are:

• AY – Journaled changes applied to physical file member
• CB – Physical file member changed
• CE – Change end of data for physical file
• CH – Change file
• CL – Physical file member closed
• CR – Physical file member cleared
• C1 – End rollback
• DE – Physical file member deleted record count
• DM – Delete member
• EJ – Journaling for physical file member ended
• EP – Journaling for access path ended
• FD – Physical file member forced to auxiliary storage
• FI – Internal journal entry format information
• IT – Identity value
• IU – Physical file member in use at abnormal termination
• IZ – Physical file member initialized
• JC – Change journaled object attribute
• JM – Journaling for physical file member started
• JP – Journaling for access path started
• MC – Create member
• MD – Member removed from physical file
• MF – Storage for physical file member freed
• MM – Physical file containing member moved
• MN – Physical file containing member renamed
• MO – Allow use with partial transaction
• MR – Physical file member restored
• MS – Physical file member saved
• OP – Physical file member opened
• PD – Access path deleted
• PM – Access path moved
• PN – Access path renamed
• RC – Journaled changes removed from physical file member
• RG – Physical file member reorganized
• RM – Member reorganized
• SA – Point at which APYJRNCHG command started execution
• SR – Point at which RMVJRNCHG command started execution
• SS – Start of save-while-active of physical file member

For journal code I the possible journal entry types are:

• DA – Directory in use at abnormal end
• DK – Internal entry
• IB – Access path protection
• IC – Access path protection
• IE – Directory recovery
• IF – Access path protection
• IG – Access path restored
• IH – Access path protection
• IK – Access path protection
• II – Access path in use at abnormal end
• IO – Access path protection
• IQ – Access path protection
• IV – Access path protection
• IW – Access path protection
• IX – Start of save for access path
• IY – Access path saved
• UE – Unknown entry type this release
• 0A-thru-19 – Db2 Mirror operation

For journal code J the possible journal entry types are:

• CI – Journal caching started
• CX – Journal caching stopped
• EZ – End journaling for journal receiver
• IA – System IPL after abnormal system end
• IN – System IPL after normal system end
• JI – Journal receiver in use at abnormal end
• JR – Start journaling for journal receiver
• JQ – Journal quiesce
• KR – Keep journal receivers for recovery
• LA – Activate journal
• LI – Inactivate journal
• MJ – Journal receiver moved
• NK – Do not keep journal receivers for recovery
• NR – Identifier for next journal receivers
• PR – Identifier for previous journal receivers
• RD – Journal receiver deleted
• RF – Storage for journal receiver freed
• RR – Journal receiver restored
• RS – Journal receiver saved
• SI – Enter JRNSTATE(STANDBY)
• SL – Severed IASP link
• SX – Exit JRNSTATE(STANDBY)
• UA – User ASP vary on abnormal
• UN – User ASP vary on normal
• XP – Internal entry for receiver
• ZA – Change authority for receiver
• ZB – Object attribute change for receiver
• ZO – Change owner for receiver
• ZP – Change primary group for receiver
• ZT – Change audit attribute for receiver

For journal code L the possible journal entry types are:

• LK – License key not valid
• LL – Usage limit changed
• LU – Usage limit exceeded

For journal code M the possible journal entry types are:

• MP – Modification of QoS policies
• SN – Simple Network Management Protocol (SNMP) information
• TF – IP filter rules actions
• TN – IP NAT rules actions
• TS – VPN information

For journal code P the possible journal entry types are:

• TP – Shared pool change

For journal code Q the possible journal entry types are:

• QA – Data queue created
• QB – Start data queue journaling
• QC – Data queue cleared, no key
• QD – Data queue deleted
• QE – End data queue journaling
• QF – Change journaled object attribute
• QG – Data queue attribute changed
• QH – Data queue changes applied
• QI – Queue in use at abnormal end
• QJ – Data queue cleared, has key
• QK – Send data queue entry, has key
• QL – Receive data queue entry, has key
• QM – Data queue moved
• QN – Data queue renamed
• QR – Receive data queue entry, no key
• QS – Send data queue entry, no key
• QW – APYJRNCHG command started
• QX – Start of save-while-active for data queue
• QY – Data queue saved
• QZ – Data queue restored
• VE – Internal entry
• VQ – Internal entry
• VW – Internal entry
• ZA – Change authority
• ZB – Object attribute change
• ZO – Change owner
• ZP – Change primary group
• ZT – Change audit attribute

For journal code R the possible journal entry types are:

• BR – Before-image of record updated for rollback
• DL – Record deleted from physical file member
• DR – Record deleted for rollback
• IL – Increment record limit
• PT – Record added to physical file member
• PX – Record added directly to physical file member
• UB – Before-image of record updated in physical file member
• UP – After-image of record updated in physical file member
• UR – After-image of record updated for rollback

For journal code S the possible journal entry types are:

• AL – SNA alert focal point information
• CF – Mail configuration information for SNA distribution services (SNADS) and mail server framework
• DX – X.400 debug entry
• ER – Mail error information for SNADS and mail server framework
• LG – Mail logging information for SNADS and mail server framework
• MX – X.400 MTA configuration
• NG – Non-delivery mail generated
• NL – New mail logging table information
• NX – X.400 delivery notification
• RT – Mail routing information for SNADS and mail server framework
• RX – X.400 Route configuration
• SH – SMTP configuration changed
• SJ – Mail delivery request generated
• SY – Mail system information for SNADS and mail server framework
• SZ – Mail delivery task completed
• TM – Transferring mail status changed
• UX – X.400 User or probe MPDU
• XE – DSNX error information
• XL – DSNX logging information
• XX – Error detected by X.400

For journal code T the possible journal entry types are:

• AD – Object auditing attribute change
• AF – Authority failure
• AP – Program adopt
• AU – Attribute changed
• AX – Row and column access control
• CA – Change of authority
• CD – Command string
• CO – Object created
• CP – User profile changed, created, or restored
• CQ – Change request description object change
• CU – Cluster operation
• CV – Connection verification
• CY – Cryptographic configuration
• C3 – Configuration
• DI – Directory services
• DO – Object deleted
• DS – DST password reset request
• EV – Environment variable
• FT – FTP client operations
• GR – General purpose audit record
• GS – Give descriptor
• IM – Intrusion monitor
• IP – Interprocess communication
• IR – IP rules actions
• IS – Internet security management
• JD – CHGJOBD of user value
• JS – Job data
• KF – Key ring file
• LD – Link/unlink/lookup directory entry
• ML – Office services mail audit record
• M0 – Db2 Mirror setup tools
• M6 – Db2 Mirror communication services
• M7 – Db2 Mirror replication services
• M8 – Db2 Mirror product services
• M9 – Db2 Mirror replication state
• NA – Change to network attribute
• ND – Directory search violation
• NE – End point violation
• OM – Object management change
• OR – Object restore
• OW – Object ownership change
• O1 – Single optical object access
• O2 – Dual optical object access
• O3 – Optical volume access
• PA – CHGPGM to adopt owner
• PF – PTF operations
• PG – Object primary group change
• PO – Printed output
• PS – Process user profile exchange
• PU – PTF object changes
• PW – Password or user ID not valid
• RA – Restore object and authority change
• RJ – JOBD with user restored
• RO – Restore object and owner change
• RP – Adopting program restored
• RQ – Change request description object restored
• RU – Restore of authority
• RZ – Primary group change on restore
• SD – Change system directory
• SE – Change to subsystem routing
• SF – Spooled output file
• SG – Asynchronous signals
• SK – Secure sockets connections
• SM – System management
• SO – Server security change
• ST – Service tools
• SV – Change to system value
• VA – Access control list change
• VC – Connection start and end
• VF – Server files closed
• VL – Account limit exceeded
• VN – Network logon and logoff
• VO – Actions on validation lists
• VP – Network password error
• VR – Network resource access
• VS – Server session start or end
• VU – Network profile change
• VV – Service status change
• XD – Directory services extension
• X0 – Network authentication
• X1 – Identity Token
• X2 – Query manager profile changes
• X3 – Reserved audit entry
• X4 – Reserved audit entry
• X5 – Reserved audit entry
• X6 – Reserved audit entry
• X7 – Reserved audit entry
• X8 – Reserved audit entry
• X9 – Reserved audit entry
• YC – DLO change access
• YR – DLO read access
• ZC – Audit object change
• ZR – Audit read access

For journal code U the possible journal entry types are:

• ** – User generated entry (SNDJRNE command or QJOSJRNE API)

For journal code Y the possible journal entry types are:

• LF – Logical file association
• YA – Change library attribute
• YB – Start journal for library
• YD – Library deleted
• YE – End journal for library
• YH – Library changes applied
• YI – Library in use at abnormal end
• YK – Change journaled object attribute
• YN – Library renamed
• YO – Object added to library
• YS – Library saved
• YW – Start of save for library
• YY – APYJRNCHG command started
• YZ – Library restored
• ZA – Change authority
• ZB – Object attribute change
• ZO – Change owner
• ZP – Change primary group
• ZT – Change audit attribute