× The internal search function is temporarily non-functional. The current search engine is no longer viable and we are researching alternatives.
As a stop gap measure, we are using Google's custom search engine service.
If you know of an easy to use, open source, search engine ... please contact support@midrange.com.



Jim,

How about using the network apis to determine the remote host?

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Jim Franz
Sent: Tuesday, March 17, 2015 12:07 PM
To: Midrange Systems Technical Discussion
Subject: Re: odd profile swap in QAUDJRN

Gary,

but user is not actively doing anything. In fact, when 1st started, computer on, but user not in the building.
Malwarebytes shows clean (as far as network staff can tell).
That's why I'm trying to determine if a normal map drive issue (like saved credentials but not updated on last pwd chg) or some printer mapping, or some client app.
I do see netserver ptfs related to security we don't have.
I guess what I'm looking for is a Netserver code that indicates "what" is it attempting to do?
btw - the attempts (VP) are about 5 minutes apart, but not exact.
The job stack of the pc is pages of stuff.
Jim

On Tue, Mar 17, 2015 at 2:46 PM, Monnier, Gary <Gary.Monnier@xxxxxxxxx>
wrote:

Jim,



Doesn't the contents of the VP entry give you the information you need?



JE J4 J5 Field Format Description

156 224 610 Error Type Char(1) The type of error that occurred. P =
Password error

157 225 611 Server Name Char(10) The name of the network server
description that registered the event.

167 235 621 Server Date Char(6) The date the event was logged on the
network server.

173 241 627 Server Time Zoned(6,0) The time the event was logged on the
network server.

179 247 633 Computer Name Char(8) The name of the computer initiating
the request.

187 255 641 User Char(10) The name of the user who attempted to
log on.



-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Jim Franz
Sent: Tuesday, March 17, 2015 11:14 AM
To: Midrange Systems Technical Discussion
Subject: Re: odd profile swap in QAUDJRN



It's not getting that far. The VP code indicates pwd error.

Trying to determine if this is a mapped drive trying to reconnect
(over &

over)?

Jim



On Tue, Mar 17, 2015 at 1:50 PM, <rob@xxxxxxxxx> wrote:



Methinks thou art correct.

QZLSFILET

Servicing user profile A from client 10.17.8.33.

Servicing user profile B from client 10.10.2.96.

Ended service for user A on client 10.17.8.33.

Ended service for user B on client 10.10.2.96.

Servicing user profile B from client 10.17.8.33.

Servicing user profile C from client 10.10.9.22.

Servicing user profile A from client 10.10.8.237.

Servicing user profile D from client 10.17.9.92.





Rob Berendt

--

IBM Certified System Administrator - IBM i 6.1

Group Dekko

Dept 1600

Mail to: 2505 Dekko Drive

Garrett, IN 46738

Ship to: Dock 108

6928N 400E

Kendallville, IN 46755

http://www.dekko.com











From: Charles Wilt <charles.wilt@xxxxxxxxx>

To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>

Date: 03/17/2015 01:41 PM

Subject: Re: odd profile swap in QAUDJRN

Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>







Rob,



I don't think the connections are actually serviced under that job...



Instead it is QZLSFILET or QZLSFILE

https://www-304.ibm.com/support/docview.wss?uid=nas8N1015061



Charles









On Tue, Mar 17, 2015 at 12:03 PM, <rob@xxxxxxxxx> wrote:



QZLSSERVER is IBM Net Server. This basically serves up shares on
your

IBM

i. So if someone maps a drive to /youribmi/yourshare it should
appear

in

these.



However, I have a drive mapped and I only have one QZLSSERVER job
and

it's

"current user" is QPGMR

Current user profile . . . . . . . . . . . : QPGMR

Job user identity . . . . . . . . . . . . . : QPGMR

So apparently it's not swapped all the time. IDK if the swap is
done

very

quickly.



On a side note, there's also a way to set up a "guest" account so
that

users who do not have access to your IBM i will also use a generic

account

for drive mapping.



Rob Berendt

--

IBM Certified System Administrator - IBM i 6.1

Group Dekko

Dept 1600

Mail to: 2505 Dekko Drive

Garrett, IN 46738

Ship to: Dock 108

6928N 400E

Kendallville, IN 46755

http://www.dekko.com











From: Jim Franz <franz9000@xxxxxxxxx>

To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx


Date: 03/17/2015 11:41 AM

Subject: odd profile swap in QAUDJRN

Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>







How can I determine what was being executed when this Profile Swap

occurred?



Profile NETTST (not a test account, it's part of a name)

QZLSSERVER doesn't log much (I changed jobd to log all before this

occurred)



No activity immed before or after this time for this user.

Nothing in QHST for this user.

User does use a client based app (package) to access our system
and was

active till about 20 minutes before this swap.







1660700 T 0 'PNETTST M '



0 PS QZLSSERVER QPGMR 776279 0



0 QLESPI QSECOFR 0 0



0 03/16/15 18:06:58 0





Jim Franz

--

This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit: http://lists.midrange.com/mailman/listinfo/midrange-l

or email: MIDRANGE-L-request@xxxxxxxxxxxx

Before posting, please take a moment to review the archives

at http://archive.midrange.com/midrange-l.







--

This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit: http://lists.midrange.com/mailman/listinfo/midrange-l

or email: MIDRANGE-L-request@xxxxxxxxxxxx

Before posting, please take a moment to review the archives

at http://archive.midrange.com/midrange-l.





--

This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit: http://lists.midrange.com/mailman/listinfo/midrange-l

or email: MIDRANGE-L-request@xxxxxxxxxxxx

Before posting, please take a moment to review the archives

at http://archive.midrange.com/midrange-l.







--

This is the Midrange Systems Technical Discussion (MIDRANGE-L)
mailing
list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit: http://lists.midrange.com/mailman/listinfo/midrange-l

or email: MIDRANGE-L-request@xxxxxxxxxxxx

Before posting, please take a moment to review the archives

at http://archive.midrange.com/midrange-l.





--

This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit: http://lists.midrange.com/mailman/listinfo/midrange-l

or email: MIDRANGE-L-request@xxxxxxxxxxxx

Before posting, please take a moment to review the archives

at http://archive.midrange.com/midrange-l.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take
a moment to review the archives at
http://archive.midrange.com/midrange-l.


--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a moment to review the archives at http://archive.midrange.com/midrange-l.


As an Amazon Associate we earn from qualifying purchases.

This thread ...

Follow-Ups:
Replies:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2024 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].

Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.