why was a device varied off? (API?)

Browsing through the archives, I even found a post I sent that said a
device varied off by invalid signon would not automatically vary back on
when a PC5250 telnet session tried to use it.

I'm trying to find the devices that are varied off due to inactivity vs
those varied off by users.  Is there a flag somewhere that we can get to?

The plan is to delete varied off devices (another archive post covers
this method as well) but I do not want to delete a device that was
varied off by a user.  The theory is that someone tried to hack in on
that device, so it should remain intact and varied off.

We just want to clean up the mess in an automated fashion without
increasing our security risk.  We're up to about 2000 users in 148
locations, so the days of "just trust them" are long gone.

Thanks, all.
--
Sean Porterfield