Re: Finding IP address of Failed Login Attempt

If the device is at a signon display you can use the API QDCRDEVD.
quick example:
http://www.systeminetwork.com/isnetforums/archive/index.php?t-38125.html


If that is not possible you can setup a telnet exit program
A simple one can be found here:
http://publib.boulder.ibm.com/infocenter/iseries/v5r3/index.jsp?topic=/rzaiw/rzaiwexitsample.htm

You would then just have to match up the time stamps to find the IP address

Bryan



ALopez@xxxxxxxxxx said the following on 5/2/2007 8:44 AM:

We run a nightly report using DSPAUDJRNE ENTTYP(PW). This report has ballooned to hundreds of pages because of one user id.

VIOLATION USER USER DEVICE REMOTE LOCAL NETWORK JOB JOB TYPE PROFILE NAME NAME NAME NAME ID NAME USER PW Q QTCP MATTHEW QTVDEVICE QTCP PW Q QTCP MATTHEW QTVDEVICE QTCP
I've spoken with the user and he is unaware of these attempts. The times show that they occur at 2 minute intervals. I suspect that the user was signed in on a 5250 emulation session with reconnect enabled, changed his password on another session/terminal, and now the original device keeps retrying with an old password.
Is there a way to track down the IP address of these attempts, or even the workstation id that it is using? I've looked at the job log for QTVDEVICE. It doesn't seem to give any info that would help me track down the origin. The sign on server doesn't show any entries in the job log and I can't seem to hit a decent search pattern on either Midrange.com or Google.