spy out who delete the records in F4111

hi,list

someday early , we find that 2/3(about 4M) of the records in F4111 was deleted. the deleted records is like this : ILDCT = I* or ILDCT =CA or so.i can't say it very clearly(for my poor english ),but am sure that one big type(stock adjust type?)is completely wiped out,and other type not delete.

now i think there maybe 2 possible:
1. a very prefessional person delete it . but this possibility is very little possible at all.
2 . a man running a report, and changed some process option by an accident.(for example ,R41413,there is a optin to delete records).he don't know it at all.

no matter who and why delete the records,i have to track him out and prevent it from happaning again.i think the 2nd possibility is more possible,and find a F01131 seems to records nearly every UBE that has been run.but still i can't find anything help.time is limit,so i coming here for a helping hand.

btw:maybe he delete it by a SQL statement,if so,is there a table store it ?
i use AS/400,db2.

any help will be very appreciated.

bee

Deleted records on the AS/400 are still in the file until a CLRPFM or
RGZPFM is run. The "deleted" records just have hex value changed so they
can be reactivated and a number of tools are available to do this. You
might like to try www.taatool.com as they supply a library with a number
of useful commands including RTVDLTRCD (retrieve deleted records).
Regards Max Brown



AS/400,V4R5, B7321,SP 12.5,Coexistence,Going to Xe(before Y3K), NT2000

hi,maxbrown,
thank u for your message.
But now finding out who and why , and prevent it from happaning again , is much more important than recover the lost data.

bee

You could try checking your journals on the AS/400 . they do have
job/user/application information.

Thanks
George
Berri Limited

Oneworld Xe
SP18
AS/400 V5R1
Citrix XP


**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager ( [email protected] )

Important Notice: Berri Limited scans all incoming and outgoing
emails for possible inappropriate content. Procedures to rectify
problems with the email system may result in others reviewing
the content of any incoming or outgoing email.

The Berri Limited Email system is for Business use only.

**********************************************************************