Definition
QAUDJRN is the IBM i security audit journal in QSYS. When security auditing is configured, IBM i writes selected events to the journal, including authority failures, profile changes, authority changes, object activity, auditing changes, and other actions chosen through system, user, and object auditing settings.
QAUDJRN is not a SIEM feed by itself. The organization still needs to manage journal receivers, protect and retain the evidence, extract the required entry types, map their fields, forward them, and monitor delivery into the destination platform.