Re: Systematically deleting spool files meeting certain criteria

I would think a comm trace would show you the IP address of the offender.
WRKLIND
STRCMNTRC CFGOBJ(LANLINSYS) CFGTYPE(*LIN) MAXSTG(32M)
ENDCMNTRC CFGOBJ(LANLINSYS) CFGTYPE(*LIN)
PRTCMNTRC CFGOBJ(LANLINSYS) CFGTYPE(*LIN) FMTTCP(*YES)
Using the FMTTCP(*YES) shows the IP address
Record Controller Destination Source Frame
Timer Name MAC Address MAC Address Format Co
--------------- ---------- ------------ ------------ ------ --
15:35:04.112306 020037440000 001DE64EDA60 ETHV2 T
Frame Type : IP DSCP: 0 ECN: 00-NECT Length: 40 P
Src Addr: 10.10.8.237 Dest Addr: 10.17.6.129

There should be enough there to help hang the guilty party.

DLTCMNTRC CFGOBJ(LANLINSYS) CFGTYPE(*LIN)

Some job logs will give you a little assistance
Job 679670/QUSER/QRWTSRVR
Message . . . . : Target job assigned to handle DDM connection started
by
source system over TCP/IP.
Cause . . . . . : A distributed data management (DDM) connection has
been
started over TCP/IP by source system job JT400 on source system *N. See

source job JT400 for all additional messages regarding the DDM
connection.
DDM uses remote IP address 10.17.9.110 and remote port 4136 for this
TCP/IP
connection.

NSLOOKUP '10.17.9.110'

Server: 10.10.4.250
Address: 10.10.4.250#53

110.9.17.10.in-addr.arpa name = cll1.dekko-1.

I know that PC.

NETSTAT *CNN
F15=Subset
If I pick 10.10.8.237 (currently my pc)
Remote Remote Local
Address Port Port Idle Time State
10.10.8.237 1121 telnet 000:05:17 Established
10.10.8.237 1137 netbios > 023:37:00 Established
10.10.8.237 1192 21961 000:01:07 Time-wait
10.10.8.237 1192 25517 000:00:07 Time-wait
10.10.8.237 1192 26428 000:00:50 Time-wait
10.10.8.237 1206 netbios > 696:28:42 Established
10.10.8.237 1326 1352 000:06:57 Established
10.10.8.237 1339 netbios > 456:03:16 Established
10.10.8.237 2169 as-rmtcmd 000:01:08 Established
10.10.8.237 2170 as-rmtcmd 000:12:54 Established
10.10.8.237 2171 drda 000:01:08 Established
10.10.8.237 2804 netbios > 529:35:16 Established
10.10.8.237 2929 netbios > 480:15:02 Established
10.10.8.237 3199 netbios > 503:47:27 Established
10.10.8.237 3360 netbios > 648:15:00 Established
10.10.8.237 3537 netbios > 623:42:11 Established
10.10.8.237 4338 QYPSSRV 000:00:39 Established
10.10.8.237 4342 as-signon 000:11:05 Established
10.10.8.237 4938 1352 000:10:19 Established
10.10.8.237 4941 netbios > 000:47:21 Established
10.10.8.237 4945 telnet 000:05:23 Established
10.10.8.237 4946 telnet 000:00:00 Established
10.10.8.237 4995 telnet 000:02:59 Established

Then there's this
8=Display jobs
for each entry.


Rob Berendt