RE: odd profile swap in QAUDJRN -- MIDRANGE-L

Jim,

Doesn't the contents of the VP entry give you the information you need?

JE J4 J5 Field Format Description

156 224 610 Error Type Char(1) The type of error that occurred. P = Password error

157 225 611 Server Name Char(10) The name of the network server description that registered the event.

167 235 621 Server Date Char(6) The date the event was logged on the network server.

173 241 627 Server Time Zoned(6,0) The time the event was logged on the network server.

179 247 633 Computer Name Char(8) The name of the computer initiating the request.

187 255 641 User Char(10) The name of the user who attempted to log on.

-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Jim Franz
Sent: Tuesday, March 17, 2015 11:14 AM
To: Midrange Systems Technical Discussion
Subject: Re: odd profile swap in QAUDJRN

It's not getting that far. The VP code indicates pwd error.

Trying to determine if this is a mapped drive trying to reconnect (over &

over)?

Jim

On Tue, Mar 17, 2015 at 1:50 PM, <rob@xxxxxxxxx> wrote:

Methinks thou art correct.

QZLSFILET

Servicing user profile A from client 10.17.8.33.

Servicing user profile B from client 10.10.2.96.

Ended service for user A on client 10.17.8.33.

Ended service for user B on client 10.10.2.96.

Servicing user profile B from client 10.17.8.33.

Servicing user profile C from client 10.10.9.22.

Servicing user profile A from client 10.10.8.237.

Servicing user profile D from client 10.17.9.92.

Rob Berendt

--

IBM Certified System Administrator - IBM i 6.1

Group Dekko

Dept 1600

Mail to: 2505 Dekko Drive

Garrett, IN 46738

Ship to: Dock 108

6928N 400E

Kendallville, IN 46755

http://www.dekko.com

From: Charles Wilt <charles.wilt@xxxxxxxxx>

To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>

Date: 03/17/2015 01:41 PM

Subject: Re: odd profile swap in QAUDJRN

Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>

Rob,

I don't think the connections are actually serviced under that job...

Instead it is QZLSFILET or QZLSFILE

https://www-304.ibm.com/support/docview.wss?uid=nas8N1015061

Charles

On Tue, Mar 17, 2015 at 12:03 PM, <rob@xxxxxxxxx> wrote:

QZLSSERVER is IBM Net Server. This basically serves up shares on your

IBM

i. So if someone maps a drive to /youribmi/yourshare it should appear

in

these.

However, I have a drive mapped and I only have one QZLSSERVER job and

it's

"current user" is QPGMR

Current user profile . . . . . . . . . . . : QPGMR

Job user identity . . . . . . . . . . . . . : QPGMR

So apparently it's not swapped all the time. IDK if the swap is done

very

quickly.

On a side note, there's also a way to set up a "guest" account so that

users who do not have access to your IBM i will also use a generic

account

for drive mapping.

Rob Berendt

--

IBM Certified System Administrator - IBM i 6.1

Group Dekko

Dept 1600

Mail to: 2505 Dekko Drive

Garrett, IN 46738

Ship to: Dock 108

6928N 400E

Kendallville, IN 46755

http://www.dekko.com

From: Jim Franz <franz9000@xxxxxxxxx>

To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>

Date: 03/17/2015 11:41 AM

Subject: odd profile swap in QAUDJRN

Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>

How can I determine what was being executed when this Profile Swap

occurred?

Profile NETTST (not a test account, it's part of a name)

QZLSSERVER doesn't log much (I changed jobd to log all before this

occurred)

No activity immed before or after this time for this user.

Nothing in QHST for this user.

User does use a client based app (package) to access our system and was

active till about 20 minutes before this swap.

1660700 T 0 'PNETTST M '

0 PS QZLSSERVER QPGMR 776279 0

0 QLESPI QSECOFR 0 0

0 03/16/15 18:06:58 0

Jim Franz

--

This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit: http://lists.midrange.com/mailman/listinfo/midrange-l

or email: MIDRANGE-L-request@xxxxxxxxxxxx

Before posting, please take a moment to review the archives

at http://archive.midrange.com/midrange-l.

--

This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit: http://lists.midrange.com/mailman/listinfo/midrange-l

or email: MIDRANGE-L-request@xxxxxxxxxxxx

Before posting, please take a moment to review the archives

at http://archive.midrange.com/midrange-l.

--

This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing

list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit: http://lists.midrange.com/mailman/listinfo/midrange-l

or email: MIDRANGE-L-request@xxxxxxxxxxxx

Before posting, please take a moment to review the archives

at http://archive.midrange.com/midrange-l.

--

This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit: http://lists.midrange.com/mailman/listinfo/midrange-l

or email: MIDRANGE-L-request@xxxxxxxxxxxx

Before posting, please take a moment to review the archives

at http://archive.midrange.com/midrange-l.

--

This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list

To post a message email: MIDRANGE-L@xxxxxxxxxxxx

To subscribe, unsubscribe, or change list options,

visit: http://lists.midrange.com/mailman/listinfo/midrange-l

or email: MIDRANGE-L-request@xxxxxxxxxxxx

Before posting, please take a moment to review the archives

at http://archive.midrange.com/midrange-l.