Re: Finding out who started telnet session

[Ed Fishel <edfishel@xxxxxxxxxx>]

Jeff Carey wrote on 04/04/2005 10:44:42 AM:

> Is there a way (without creating an exit point program) to tell who (by
IP
> address I guess) initiated  telnet session that useda given virtual
device
> (QPADVE*)?
>
> I'm trying to track who attempted to sign on and disabled a given user
> profile.

Hopefully you already have security auditing turned on and *AUTFAIL
specified as one of the values in the QAUDLVL (Security auditing level)
system value.  If you do then use the following DSPJRN command to copy the
PW (Password) audit records to the QASYPWJ5 file in library QTEMP. The
JORADR field in each record of that file will be the remote address of the
user that tried to sign-on with the wrong password.

DSPJRN JRN(QAUDJRN) JRNCDE((T)) ENTTYP(PW) OUTPUT(*OUTFILE)
OUTFILFMT(*TYPE5) OUTFILE(QTEMP/QASYPWJ5)
By using the "ping -a IPaddress" in DOS or NSLOOKUP command on iSeries with
the HOSTNAME parameter set to the IP address you can get back the name of
the computer the person is using.  Note: I am not a TCP/IP expert. I do not
know if these commands will work in all situations. There may be better
ways to determine a computer name from an IP address.

Ed Fishel,
edfishel@xxxxxxxxxx