Re: Last IP address used

[Wayne McAlpine <wayne.mcalpine@xxxxxxxxxxxxxxxxx>]

Good idea, Jim, provided that security auditing is enabled.

Jim Franz wrote:
> Try the audit journal entry type PW and OUTFILFMT(*TYPE5) to an *outfile
>
> sample
>                                 JOB        USER       JOB     PROGRA
> TYPE TIMESTAMP                  NAME       NAME       NUMBER  NAME
> PW   2006-11-28-08.49.37.136912 QINTER     QSYS       207546  QLESPI
> ..... many columns later
> REMOTE REMOTE
> PORT   ADDRESS
> 1243  10.0.1.80
>
> Jim Franz
>
> ----- Original Message ----- From: <rob@xxxxxxxxx>
> To: <midrange-l@xxxxxxxxxxxx>
> Sent: Tuesday, November 28, 2006 8:20 AM
> Subject: Last IP address used
>
>
> > Is there a way to see the last IP address used by a workstation?  It is
> > NOT in use now.  Had some hacking going on.
> >
> > DSPMSG QSYSMSG
> > Subsystem QINTER varied off work station QPADEV001N for user JJIIOOIO.
> > Subsystem QINTER varied off work station QPADEV001P for user GHUHUUUHUH.
> > Subsystem QINTER varied off work station QPADEV001Q for user UYHGYGGU.
> > Subsystem QINTER varied off work station QPADEV001R for user JHGFTFT.
> > Subsystem QINTER varied off work station QPADEV001S for user GFFFGFGCFG.
> > ...
> > 11/20/06 around 11:47
> > and
> > 11/14/06 around 13:13
> > and
> > 11/10/06 around 16:28
> > and
> > ...
> > and
> > ...
> > and
> > ...
> >
> > Rob Berendt
> > --
> > Group Dekko Services, LLC
> > Dept 01.073
> > PO Box 2000
> > Dock 108
> > 6928N 400E
> > Kendallville, IN 46755
> > http://www.dekko.com
> >
> > --
> > This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing 
> > list
> > To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> > To subscribe, unsubscribe, or change list options,
> > visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> > or email: MIDRANGE-L-request@xxxxxxxxxxxx
> > Before posting, please take a moment to review the archives
> > at http://archive.midrange.com/midrange-l.