Re: Log of User disabled

[Vernon Hamberg <vhamberg@xxxxxxxxxxxxxxx>]

Even easier now, if you are at 6.1 or later, is the DISPLAY_JOURNAL UDTF 
(user-defined table function)

documentation at 
https://www.ibm.com/developerworks/community/wikis/home?lang=en#!/wiki/IBM+i+Technology+Updates/page/DISPLAY_JOURNAL+(easier+searches+of+Audit+Journal)

HTH
Vern

On 7/9/2015 2:27 PM, Bryan Dietz wrote:
> I prefer a CPYAUDJRNE ENTTYP(pw) OUTFILE(QTEMP/QAUDIT) with your own 
> date range then a simple SQL
>
> select PWJOB,PWUSER,PWNBR,
>        PWPGM,PWPGMLIB,
>        PWUSRN,PWTYPE,PWDEVN,
>        PWRADR,PWRPORT,
>        PWTSTP,PWSYSSEQ,
>        PWRCV,PWRCVLIB,PWSEQN
>   from qtemp/QAUDITPW
>
>
>
> rob@xxxxxxxxx wrote on 7/9/2015 2:47 PM:
> > What is your definition of "disabled"?  To me there's two levels of
> > disabled.
> > CPF1393 - User profile DUMMY has been disabled.
> > CPIB68E: User &1 is disabled for IBM i NetServer access.
> >
> > The CPF1393 will also have
> > DSPJRN QAUDJRN
> > Code . . . . . . . . :   T  - Audit trail entry
> > Type . . . . . . . . :   CP - User profile changed
> >              Entry specific data
> > Column      *...+....1....+....2....+....3..
> > 00001      'ADUMMY     QSYS      *USRPRF CHG
> > 00051      '
> > 00101      '
> > 00151      '       *DISABLED
> >
> > When I ran
> > CHGUSRPRF USRPRF(DUMMY) STATUS(*ENABLED)
> > I got
> > Code . . . . . . . . :   T  - Audit trail entry
> > Type . . . . . . . . :   CP - User profile changed
> >               Entry specific data
> >   Column      *...+....1....+....2....+....3..
> >   00001      'ADUMMY     QSYS      *USRPRF CHG
> >   00051      '
> >   00101      '
> >   00151      '       *ENABLED
> >
> >
> > This is when we normally get the question:  Is there any way to find 
> > this
> > without using any effective tools like journals?
> >
> > See also:
> >
> > DSPLOG MSGID(CPF2234 CPF1393)
> > Password from device DSP010000 not correct for user DUMMY.
> > Password from device DSP010000 not correct for user DUMMY.
> > Password from device DSP010000 not correct for user DUMMY.
> > User profile DUMMY has been disabled.
> > There will be NO DSPLOG entry to match the CHGUSRPRF USRPRF(DUMMY)
> > STATUS(*ENABLED)
> >
> > CPIB68F: User &1 was enabled for IBM i NetServer access.
> >
> >
> > Rob Berendt