Re: Last IP address used

Try the audit journal entry type PW and OUTFILFMT(*TYPE5) to an *outfile

sample
                                JOB        USER       JOB     PROGRA
TYPE TIMESTAMP                  NAME       NAME       NUMBER  NAME
PW   2006-11-28-08.49.37.136912 QINTER     QSYS       207546  QLESPI
..... many columns later
REMOTE REMOTE
PORT   ADDRESS
1243  10.0.1.80

Jim Franz

To: <midrange-l@xxxxxxxxxxxx>
Sent: Tuesday, November 28, 2006 8:20 AM
Subject: Last IP address used

Is there a way to see the last IP address used by a workstation?  It is
NOT in use now.  Had some hacking going on.

DSPMSG QSYSMSG
Subsystem QINTER varied off work station QPADEV001N for user JJIIOOIO.
Subsystem QINTER varied off work station QPADEV001P for user GHUHUUUHUH.
Subsystem QINTER varied off work station QPADEV001Q for user UYHGYGGU.
Subsystem QINTER varied off work station QPADEV001R for user JHGFTFT.
Subsystem QINTER varied off work station QPADEV001S for user GFFFGFGCFG.
...
11/20/06 around 11:47
and
11/14/06 around 13:13
and
11/10/06 around 16:28
and
...
and
...
and
...

Rob Berendt
--
Group Dekko Services, LLC
Dept 01.073
PO Box 2000
Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com

--

This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at http://archive.midrange.com/midrange-l.