RE: Repeated signon attempts mystery

Tim,

What do the PW (password) entries in QAUDJRN tell you? Output format *TYPE5
will give you the IP address. Do you recognize it?

In the entry-specific data position 1 says what type of violation occurred.

A - APPC bind failure.
C - User authentication with the CHKPWD command failed.
D - Service tools user ID name not valid.
E - Service tools user ID password not valid.
P - Password not valid.
Q - Attempted signon (user authentication) failed because user profile is
disabled.
R - Attempted signon (user authentication) failed because password was
expired. This audit record might not occur for some user authentication
mechanisms. Some authentication mechanisms do not check for expired
passwords.
S - SQL Decryption password is not valid.
U - User name not valid.
X - Service tools user ID is disabled.
Y - Service tools user ID not valid.
Z - Service tools user ID password not valid.


-----Original Message-----

date: Mon, 12 Jan 2009 09:48:35 -0500
from: "Tim Gornall" <tgornall@xxxxxxxxxx>
subject: Repeated signon attempts mystery


We have a user ID that was setup for a vendor to have access to the system
when needed. It is usually disabled unless we grant access the vendor.

This morning we attempted to enable it and found that a process is
attempting to use the ID without success. The number of failed attempts was
at 29K and rising as I type this. I assume this is a system process of some
sort. The vendor claims it is not their software.

How can I determine where this is coming from? The system log only
indicates the following message, but does not give more info.

*SIGNON server job 411537/QUSER/QZSOSIGN processing request for user... snip


Thanks, Tim