Include Specific Entry Type in SYSLOG Output from QSYS2.DISPLAY_JOURNAL

Description:

When generating SYSLOG output using the QSYS2.DISPLAY_JOURNAL function, the resulting information only includes the journal code and the journal entry type. However, it does not include the specific entry subtype contained in each entry (the first position of the ENTRY_DATA field).

Including this additional level of detail would significantly improve the ability to perform more granular analysis of journal entries—especially in scenarios where the data is forwarded to external systems such as SIEM platforms.

Use Case:

Having the specific entry subtype available would allow better filtering, correlation, and interpretation of events, leading to more precise monitoring and auditing capabilities.

Example (with invalid password entries):


SELECT SYSLOG_EVENT
FROM TABLE(QSYS2.DISPLAY_JOURNAL
(
JOURNAL_LIBRARY => 'QSYS',
JOURNAL_NAME => 'QAUDJRN',
JOURNAL_ENTRY_TYPES => 'PW',
GENERATE_SYSLOG => 'RFC5424'
)
)
WHERE SYSLOG_EVENT IS NOT NULL;

Current Behavior:

• Output includes: |T-PW|

Proposed Enhancement:

• Output includes: |T-PW-Q| (adding the specific entry subtype)

Additional Enhancement (Optional)

As an extra improvement, it would also be very valuable to include a human-readable description of the entry subtype as part of the SYSLOG output. This would make the logs more self-explanatory and reduce the need for external lookups or mappings during analysis.

Expected Benefits:

• More detailed and accurate event analysis

• Improved integration with SIEM and monitoring tools

• Reduced effort in interpreting journal entries thanks to optional descriptive context