We run a nightly report using DSPAUDJRNE ENTTYP(PW). This report has ballooned to hundreds of pages because of one user id.
VIOLATION USER USER DEVICE REMOTE LOCAL NETWORK JOB JOB TYPE PROFILE NAME NAME NAME NAME ID NAME USER PW Q QTCP MATTHEW QTVDEVICE QTCP PW Q QTCP MATTHEW QTVDEVICE QTCP
I've spoken with the user and he is unaware of these attempts. The times show that they occur at 2 minute intervals. I suspect that the user was signed in on a 5250 emulation session with reconnect enabled, changed his password on another session/terminal, and now the original device keeps retrying with an old password.
Is there a way to track down the IP address of these attempts, or even the workstation id that it is using? I've looked at the job log for QTVDEVICE. It doesn't seem to give any info that would help me track down the origin. The sign on server doesn't show any entries in the job log and I can't seem to hit a decent search pattern on either Midrange.com or Google.
As an Amazon Associate we earn from qualifying purchases.
Operating expenses for this site are earned using the Amazon Associate program and Google Adsense.