Re: Audit Journal Entry

Thanks to all for replies, I was aware that client server programs ran under
QUSER I had never considered that a password change through the GUI would
appear in the audit journal against QUSER.

Thanks again

Angus

On 01/03/07, rob@xxxxxxxxx <rob@xxxxxxxxx> wrote:

Client server programs often run underneath dummy IBM profiles like QUSER.
Then they'll use the profile handles to get into the real user.  So, you
need to NOT look at the job user to determine the user, but that other
part.  And I think it logs that in the journal entry also.
For example, if you do a WRKOBJLCK ANGUS *USRPRF (providing ANGUS is your
user id) you may see several of these locks by jobs with job users like
QUSER out there.  But really they were Client Server sessions set up via
NetServer, etc.

Rob Berendt
--
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com





"Angus MacQueen" <amacqueen@xxxxxxxxx>
Sent by: midrange-l-bounces@xxxxxxxxxxxx
03/01/2007 10:30 AM
Please respond to
Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>


To
midrange-l@xxxxxxxxxxxx
cc

Fax to

Subject
Audit Journal Entry






Can anyone explain the circumstances where the QUSER profile might be
responsible for changing a USRPRF?

We have a piece of software that monitors the audit journal and if
necessary
logs an alert by email, sms, and/or to a console and I want to consider
whether to exclude this alert if the profile is QUSER.

This is an example of the alert I get:-

Event message . . . . . :  CP - User Profile FERNJ changed by QUSER.

User profile  . . . . . :  FERNJ
Job . . . . . . . . . . :  687789/QUSER/QZSOSIGN

TIA


Angus
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.