Re: Disabled User Profiles

If you do a CRTMSGQ QSYS/QSYSMSG it will duplicate certain messages from 
QSYSOPR to this message queue.  These are "more critical" messages.  Like 
"your disk took a sh!t" or "Subsystem QINTER varied off work station 
DSTPC1S2 for user CAREN36."  Then you could hit help on it and see the 
details like:
Message ID . . . . . . :   CPF1397       Severity . . . . . . . :   70  
Message type . . . . . :   Information  
Date sent  . . . . . . :   02/10/06      Time sent  . . . . . . : 06:58:58 
 
  
Message . . . . :   Subsystem QINTER varied off work station DSTPC1S2 for 
user
  CAREN36.  
Cause . . . . . :   The maximum number of sign on attempts specified by 
system
  value QMAXSIGN has been reached.  The device has been varied off for  
  security reasons.  
Recovery  . . . :   After checking with your security officer, vary the 
device
  on using the Vary Configuration (VRYCFG) command.  


And you can spot either the really clueless, or the hackers by:
Subsystem QINTER varied off work station QPADEV003S for user TENISE70.
Subsystem QINTER varied off work station QPADEV004K for user TENISE70.
Subsystem QINTER varied off work station QPADEV004M for user TENISE70.
Subsystem QINTER varied off work station QPADEV004T for user TENISE70.
Subsystem QINTER varied off work station QPADEV004W for user TENISE70.
Subsystem QINTER varied off work station QPADEV004L for user TENISE70.
Subsystem QINTER varied off work station QPADEV0041 for user TENISE70.


Rob Berendt