IP Address not written to the Audit Journal – QAUDJRN

30 pts.
Tags:
AS/400 journaling
iSeries security
iSeries System management
QAUDJRN
I am scrutinizing my Audit Journal and came across numerous entries of type Change Password (CP) which do not have a corresponding Remote Address (IP). Although there exist entries within same time frame of the same users with complete information including the IP Address. What are the instances/cases where the Remote Address (IP) is not written to the Audit Journal. Thanks for the help in Advance
ASKED: March 26, 2009  12:09 PM
UPDATED: March 27, 2009  8:16 PM

Answer Wiki

Thanks. We'll let you know when a new response is added.

Hi,

Do you have local terminals / consoles? Is it run from a batch job?

Regards,

Martin Gilbert.

Discuss This Question: 2  Replies

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
  • ASB
    There certainly a couple of consoles, but mostly are windows-based clients. The entries I am most concerned about are Change Password (CP) which generates 2 additional SO entries before and after the CP entry. Moreover, immediately after these entries without the IP Address, there is other activity of the same user with complete information including the IP Address.
    30 pointsBadges:
    report
  • mcl
    CP entries are Change Profile and include any change to the profile, not just the password change. We see CP entries without an IP address, associated with program QLESPI and under QSYS. As far as I can tell, this happens when a user disables themselves on the grey windows signon box before they get to the green screen. However, I haven't seen any SO entries associated with the CP entries. We're running V5R4 and access is currently via IBM's iSeries Access client. Regards Mike
    2,740 pointsBadges:
    report

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Thanks! We'll email you when relevant content is added and updated.

Following