Comments on: Tracing the AS/400 User profile by IP Address while signoff

By: tomliotta

tomliotta — Tue, 25 Jan 2011 03:39:10 +0000

The basic access is through the DSPJRN command:

DSPJRN JRN(QAUDJRN) RCVRNG(*CURCHAIN) JRNCDE((T)) ENTTYP(JS) USRPRF( myUser )

I don’t know how your system handles audit journal receivers, so I don’t know if RCVRNG(*CURCHAIN) is appropriate. You might need to specify starting date and time.

Also, I don’t know anything about how jobs run on your system; so I can’t guess which job names to look for. You can possibly ignore all jobs with names that start with “Q” except for jobs that start with “QPADEV”

You might not have an audit journal and, if you do have one, you might not be authorized to look at it or the receiver might already be deleted for the time you want or your system might not be auditing Job Start (JS) data. I don’t know anything about how your system was configured nor what preparation anyone has done to it.

Your request essentially assumes that someone set your system up to audit events. If there has been no preparation, the question needs to go back to basics.

Tom

By: hmssl2k

hmssl2k — Mon, 24 Jan 2011 21:39:31 +0000

Show us your work for we can make suggestions for you.

By: syedm

syedm — Fri, 21 Jan 2011 16:23:12 +0000

We are having OS V5R3, please can you provide the complete command, as I don’t have idea how to find T/JS, and i am not sure about auditing the job jda, please let me know how to enable.

By: Tracing the Userprofile by IP Address while signoff | IP address.co.uk

Tracing the Userprofile by IP Address while signoff | IP address.co.uk — Fri, 21 Jan 2011 06:09:01 +0000

[...] Original post: Tracing the Userprofile by IP Address while signoff [...]

By: tomliotta

tomliotta — Thu, 20 Jan 2011 23:13:08 +0000

Depending on what OS version/release you’re running and which audit options you have enabled, the info might already be in your system audit journal.

For example, if you are at any current release and you’re auditing job data, you should see a T/JS entry marking the start of the job for that user. The job name will be the name of the device that the user accessed.

The ‘entry details’ should include the IP address of the PC (or whatever the remote system was).

Tom

By: hmssl2k

hmssl2k — Thu, 20 Jan 2011 21:46:57 +0000

You can assign specific display names to each session of a user. When the user logs-off it will create a job log for that device name. We do it for all our employees display stations. It does help when you need to find out what a user did.

By: syedm

syedm — Thu, 20 Jan 2011 15:35:33 +0000

User has been sign off from AS400.

For example: user sign in at 10:00 am and sign off at 11:00 am but after he sign off, at 12:00 noon i need to check from which location (PC) he gets sign in to As400, from the DSPLOG i can check only his sign in and sign off time, And i cannot trace him with workstation Id’s, i want to know from which pc he was signed in.

Thanks
Syed Muneer

By: tomliotta

tomliotta — Wed, 19 Jan 2011 22:16:31 +0000

…login from which IP Address (PC)while he is sign off from the AS400…

I don’t understand this part — “while he is sign off from the AS400″. Can you explain it, please?

Tom