Rob,
My own PC is an example, see below.
There is definitely a pattern to this.
I didn't have an open session, but my drive was connected, not disconnected.
Message ID . . . . . . : CPIAD12
Date sent . . . . . . : 03/27/17 Time sent . . . . . . :
02:00:00
Message . . . . : Servicing user profile PAULS from client 10.5.42.68.
Cause . . . . . : This prestart job is currently servicing requests for
user profile PAULS from client 10.5.42.68. The client name is either an
APPC remote location name, or a TCP/IP remote system name.
Paul
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Rob Berendt
Sent: Monday, March 27, 2017 9:33 AM
To: Midrange Systems Technical Discussion
Subject: RE: Who is using a mapped drive to IFS?
Nothing major, probably just some ransomware on their PC's just trying to encrypt all the data on your IBM i. You should create a share to your root directory to make it easier for them.
<just kidding>
These kind of questions are really open ended. Sort of like "What could have created a transaction in our item history file?" You do have a person name. This helps. And you have an IP address. Hopefully it is a device that this person normally accesses and not something caused by the shop floor all sharing the id.
- Is there a virus scanning software on the PC which is not set up to ignore drive mappings?
- Is there any shop floor automation which is set to STRPCO or some such thing to upload data?
- Did he leave a file open in Excel or some such thing which is set to automatically save the file on a periodic basis?
Could be any number of things.
Rob Berendt
--
IBM Certified System Administrator - IBM i 6.1 Group Dekko Dept 1600 Mail to: 2505 Dekko Drive
Garrett, IN 46738
Ship to: Dock 108
6928N 400E
Kendallville, IN 46755
http://www.dekko.com
From: "Steinmetz, Paul" <PSteinmetz@xxxxxxxxxx>
To: "'midrange-l@xxxxxxxxxxxx'" <midrange-l@xxxxxxxxxxxx>
Date: 03/27/2017 08:59 AM
Subject: RE: Who is using a mapped drive to IFS?
Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxx>
Mark,
I did find the sessions tab.
Network, All tasks, IBM I Netserver, Sessions.
On a related note to Netserver sessions, every morning, early hours, what
would cause a CPIAD12, daily, within a 2 hour window, for several
Netserver users, when they aren't even on the system.
Message ID . . . . . . : CPIAD12
Date sent . . . . . . : 03/27/17 Time sent . . . . . . :
02:00:00
Message . . . . : Servicing user profile PAULS from client 10.5.42.68.
Cause . . . . . : This prestart job is currently servicing requests for
user
profile PAULS from client 10.5.42.68. The client name is either an
APPC
remote location name, or a TCP/IP remote system name.
Paul
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Steinmetz, Paul
Sent: Saturday, March 25, 2017 9:59 PM
To: 'midrange-l@xxxxxxxxxxxx'
Subject: RE: Who is using a mapped drive to IFS?
Mark,
Exit point program was setup, I have those results.
I also created a monitor for CPIAD12, also have those results.
Thanks
Paul
-----Original Message-----
From: MIDRANGE-L [mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of
Mark S Waterbury
Sent: Saturday, March 25, 2017 6:48 PM
To: midrange-l@xxxxxxxxxxxx
Subject: Re: Who is using a mapped drive to IFS?
Paul:
You could use a security user exit for "file server" to record such
information where ever you wanted -- see QIBM_QPWFS_FILE_SERV under
WRKREGINF to see if you have such an exit program already registered.
If not, just search for "QIBM_QPWFS_FILE_SERV" with google to learn more
about this exit point.
HTH,
Mark
On 3/25/2017 3:46 PM, Steinmetz, Paul wrote:
Mark,
I showed up under one of the QZLSFILE jobs and under go NETS 15. Work
with NetServer Sessions.
Opt Workstation Name User Name Session Number
10.5.42.68 PAULS 6025
But when I went to display, Session no longer active. Press F5 to
refresh the display.
I actually asked the wrong question.
Who has a mapped drive, may not be currently active.
Users that use mapped drives may only have them open for a few minutes,
then close.
Need a way of logging who is connecting to a mapped drive.
Nothing in QHST.
Possibly monitoring for CPIAD12 in the QZLSFILE joblog.
Message ID . . . . . . : CPIAD12
Date sent . . . . . . : 03/25/17 Time sent . . . . . . :
15:28:07
Message . . . . : Servicing user profile PAULS from client 10.5.42.68.
Cause . . . . . : This prestart job is currently servicing requests
for user
profile PAULS from client 10.5.42.68. The client name is either an
APPC
remote location name, or a TCP/IP remote system name.
Paul
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at
http://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related
questions.
Help support midrange.com by shopping at amazon.com with our affiliate
link:
http://amzn.to/2dEadiD
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
list To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe,
unsubscribe, or change list options,
visit:
http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at
http://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxx for any subscription related
questions.
Help support midrange.com by shopping at amazon.com with our affiliate
link:
http://amzn.to/2dEadiD
midrange.com
