Use the following command to display the contents of the audit journal on the iSeries:

DSPJRN JRN(QSYS/QAUDJRN) FROMTIME(092807 080000) JRNCDE((T *ALLSLT)) ENTTYP(AF)

This is very useful when researching security issues.