Good idea, Jim, provided that security auditing is enabled. Jim Franz wrote:
Try the audit journal entry type PW and OUTFILFMT(*TYPE5) to an *outfile sample JOB USER JOB PROGRA TYPE TIMESTAMP NAME NAME NUMBER NAME PW 2006-11-28-08.49.37.136912 QINTER QSYS 207546 QLESPI ..... many columns later REMOTE REMOTE PORT ADDRESS 1243 10.0.1.80 Jim Franz ----- Original Message ----- From: <rob@xxxxxxxxx> To: <midrange-l@xxxxxxxxxxxx> Sent: Tuesday, November 28, 2006 8:20 AM Subject: Last IP address usedIs there a way to see the last IP address used by a workstation? It is NOT in use now. Had some hacking going on. DSPMSG QSYSMSG Subsystem QINTER varied off work station QPADEV001N for user JJIIOOIO. Subsystem QINTER varied off work station QPADEV001P for user GHUHUUUHUH. Subsystem QINTER varied off work station QPADEV001Q for user UYHGYGGU. Subsystem QINTER varied off work station QPADEV001R for user JHGFTFT. Subsystem QINTER varied off work station QPADEV001S for user GFFFGFGCFG. ... 11/20/06 around 11:47 and 11/14/06 around 13:13 and 11/10/06 around 16:28 and ... and ... and ... Rob Berendt -- Group Dekko Services, LLC Dept 01.073 PO Box 2000 Dock 108 6928N 400E Kendallville, IN 46755 http://www.dekko.com --This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing listTo post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options, visit: http://lists.midrange.com/mailman/listinfo/midrange-l or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.
This mailing list archive is Copyright 1997-2015 by MIDRANGE dot COM and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available here. If you have questions about this, please contact