RE: Determine how pwrdwnsys was executed

If the user is audited you can use DSPJRN to list the T-CD entries for the job. This will provide a timeline of the commands run.

Thanks,

Gary Monnier



-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Jim Franz
Sent: Tuesday, June 07, 2016 11:19 AM
To: Midrange Systems Technical Discussion
Subject: Determine how pwrdwnsys was executed

Looking for clues to determine what happened.
V7R1 development system cume 15142
IBM iAccess for windows 7.1 latest svc pack

What we know so far is that a user logged onto a development system (to do
some testing.
1 minute later QHST log indicates PWRDWNSYS initiated by the user, but
users log (with 4 00 *seclvl and log CL *YES in jobd ) shows no command
line entry of any command. Her story is no menu options executed...

No menu source shows pwrdwnsys or endsys (have searched for an api but not
found one). Aware of GO POWER menu but not found a menu to connect to this.

Message ID . . . . . . : CPI0995 Severity . . . . . . . :
00
Message type . . . . . :
Information
Date sent . . . . . . : 06/07/16 Time sent . . . . . . :
11:01:49


Message . . . . : PWRDWNSYS command issued with parameters
specified.
Cause . . . . . : The Power Down System (PWRDWNSYS) command was requested
by
job 477963/XXXXX/BS7515C with the following parameters
specified:
-- How to end
*IMMED
-- Delay time
3600
-- Restart options
*NO
-- IPL source
*PANEL
-- End subsystem option
*DFT
-- Timeout option
*CONTINUE
-- Confirm
*ENVVAR
-- Image catalog

From job . . . . . . . . . . . : QSYSARB4

User . . . . . . . . . . . . : QSYS
Number . . . . . . . . . . . : 390670

From program . . . . . . . . . : QWCASDSM

Only other odd item is in user's job log, Image Catalogs on system unloaded
(CPCBC11) in 12 seconds prior to message about PWRDWNSYS (CPF0901) - I
would have expected "after".

No packaged exit programs (have recommended previously..)
QAUDJRN is active - not sure how to see remote command...

Auditing
options
*ATNEVT
*SECURITY
*PGMFAIL
*SAVRST
*AUTFAIL
*SERVICE
PC has been scanned

Jim