Re: Finding IP address of Failed Login Attempt

ALopez wrote on 05/02/2007 12:44:40 PM:

We are on V5R4, as current on CUMEs as one can get. I assume that
CPYAUDJRNE displays with *TYPE5--there doesn't seem to be an option to
control that.

For kicks, I followed the steps as though we were on a prior release, and

I can see plenty of IP addresses under other types of entries. PW

entries

do not have this information.

I also see a few PW audit records without any value for the Remote Address
field. Perhaps some of these other fields will help you determine what is
going on. The complete list of violation types can be found in Appendix F
of the Security Reference manual.

Seq Field Text
10 PWTSTP Timestamp of entry
20 PWRADR Remote address
30 PWTYPE P-Pwd, U-User name, A-APPC, D-DST user, E-
40 PWJOB Name of job
50 PWUSER Name of user
60 PWNBR Number of job
70 PWPGM Name of program
80 PWUSPF User profile
90 PWRPORT Remote port
100 PWDEVN Device name

Ed Fishel,
edfishel@xxxxxxxxxx