Re: [Security400] Logging ip address of failed authentications

["John Earl" <john.earl@xxxxxxxxxxxxxxxxxx>]

> I do a DSPAUDJRNE to see authorization
> failures such as PW (password failure.)
>
> This shows me when a user tried to sign
> on with an invalid password, and how they
> tried such as WEB, QINTER, etc.  But what
> I really want to see if the IP address of the
> client.
>
> I can get this by going to the firewall logs
> and viewing entries at the time of the failure
> (I have timesync) - but this is very time
> consuming.
>
> Is there a way on the AS/400 to show a list
> like DSPAUDJRNE and have the IP address of the
> failed client?


No, not the DSPAUDJRNE command, but you can see it if you run the DSPJRN
command and you are at V5R1 or higher.

V5R1 supports outfile format type 5 which includes IP address.  The command:

DSPJRN JRN(QAUDJRN) ENTTYP(PW) OUTPUT(*OUTFILE) OUTFILFMT(*TYPE5)
OUTFILE(MYLIB/MYFILE)

Will show you want you desire.

jte