Re: [Security400] Logging ip address of failed authentications

["John Earl" <john.earl@xxxxxxxxxxxxxxxxxx>]

> > Is there a way on the AS/400 to show a list
> > like DSPAUDJRNE and have the IP address of the
> > failed client?
>
> No, not the DSPAUDJRNE command, but you can see it if you run the DSPJRN
> command and you are at V5R1 or higher.
>
> V5R1 supports outfile format type 5 which includes IP address.  The
command:
>
> DSPJRN JRN(QAUDJRN) ENTTYP(PW) OUTPUT(*OUTFILE) OUTFILFMT(*TYPE5)
> OUTFILE(MYLIB/MYFILE)
>
> Will show you want you desire.

Actually, it doesn't show it (you probably guessed that :) but it will put a
correlating entry into a databse file that you can use any number of tools
to display.  You still have to apply a format to the tool in order to make
that ugly journal information make sense.

jte


--
John Earl - CTO
The Powertech Group Inc. Seattle, Washington
www.powertechgroup.com  john.earl@powertechgroup.com

Phone: +1-253-872-7788
Fax:      +1-253-872-7904
--