Wanna see IP or device name in OS/400?

10 pts.
Tags:
AS/400
AS/400 user profiles
IP address
OS/400
How can I see the device name or IP address of a person who disabled user profile by hitting wrong passwords in OS400 environment?

Software/Hardware used:
OS400/AS400

Answer Wiki

Thanks. We'll let you know when a new response is added.

If you have journaling turned on, you can use the CPYAUDJRNE command to create a file of changed user profiles called CPRADR. This file should contain all of the information you are looking for.

Something like this:

<pre>
CPYAUDJRNE ENTTYP(CO DO CP) OUTFILE(QAUDIT) +
JRNRCV(*CURCHAIN) FROMTIME(&YESTERDAY) +
TOTIME(&TODAY 000000)

CPYF FROMFILE(QTEMP/QAUDITCP) +
TOFILE(myLib/myQAUDITCP) MBROPT(*ADD) +
FMTOPT(*MAP)

</pre>

Each entry type will be place in its own file and the command defaults to QTEMP as the location for the file. You can leave it there and copy it out is I did in the example above, or you can enter the name of the library you want the file written to.

Discuss This Question: 4  Replies

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
  • TomLiotta
    If you are auditing security events, you should see a Password (PW) entry just before the profile is disabled. If you are on a reasonably current release of the OS, the IP address should be logged in the journal entry header. But it might not be a remote access event. You might need to look at other entry header fields to determine which job had the access attempts. Tom
    125,585 pointsBadges:
    report
  • Bigmac46
    DSPLOG to *print Search report generated for CPF1393 or disabled exmple of line you find is "CPF1393 70 INFO User profile userName has been disabled".
    1,000 pointsBadges:
    report
  • Bigmac46
    then search for userNameto get: "CPF2234 30 INFO Password from device GW1317T3 not correct for user userName". for me the next line in the report after disabled line was : "CPC2621 10 COMPLETION Warning. Device GW1317T3 varied off while in session" which might not happen in all cases depending on timing for log entries.
    1,000 pointsBadges:
    report
  • Mkashifsiddiqui
    [...] Wanna see IP or device name in OS/400? [...]
    0 pointsBadges:
    report

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Thanks! We'll email you when relevant content is added and updated.

Following