Re: Question on QTVDEVICE job entering incorrect password

Paul Jackson wrote on 04/05/2007 01:26:57 PM:

I am noticing a lot of entries in our audit log with the type of T-PW
(Invalid password entered), but are generated from the job QTVDEVICE
user QTCP.

Perhaps some of the other fields from the PW audit record would help you
determine the source of the invalid passwords. A description of the values
of the Violation Entry Type field can be found in Appendix F of the
Security Reference manual. Other fields that should be helpful are the
Address family, Remote port, and Remote address fields. These fields should
contain the address of whoever (or whatever) is failing to sign on.

If you are on a V5R4 system then use the CPYAUDJRNE command to copy the PW
audit records to a physical file and then do a query of that file. If you
are on an earlier release then just use CRTDUPOBJ to make a copy of file
QASYPWJ5 into QTEMP and then use DSPJRN to copy the PW audit records into
that file before doing the query. I hope this helps.

Ed Fishel,
edfishel@xxxxxxxxxx