Good idea, Jim, provided that security auditing is enabled.
Jim Franz wrote:
Try the audit journal entry type PW and OUTFILFMT(*TYPE5) to an *outfile
sample
JOB USER JOB PROGRA
TYPE TIMESTAMP NAME NAME NUMBER NAME
PW 2006-11-28-08.49.37.136912 QINTER QSYS 207546 QLESPI
..... many columns later
REMOTE REMOTE
PORT ADDRESS
1243 10.0.1.80
Jim Franz
----- Original Message ----- From: <rob@xxxxxxxxx>
To: <midrange-l@xxxxxxxxxxxx>
Sent: Tuesday, November 28, 2006 8:20 AM
Subject: Last IP address used
Is there a way to see the last IP address used by a workstation? It is
NOT in use now. Had some hacking going on.
DSPMSG QSYSMSG
Subsystem QINTER varied off work station QPADEV001N for user JJIIOOIO.
Subsystem QINTER varied off work station QPADEV001P for user GHUHUUUHUH.
Subsystem QINTER varied off work station QPADEV001Q for user UYHGYGGU.
Subsystem QINTER varied off work station QPADEV001R for user JHGFTFT.
Subsystem QINTER varied off work station QPADEV001S for user GFFFGFGCFG.
...
11/20/06 around 11:47
and
11/14/06 around 13:13
and
11/10/06 around 16:28
and
...
and
...
and
...
Rob Berendt
--
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.
