Re: Finding IP address of Failed Login Attempt

ALopez wrote on 05/02/2007 12:44:40 PM:

> We are on V5R4, as current on CUMEs as one can get.  I assume that
> CPYAUDJRNE displays with *TYPE5--there doesn't seem to be an option to
> control that.
>
> For kicks, I followed the steps as though we were on a prior release, and

> I can see plenty of IP addresses under other types of entries.  PW
entries
> do not have this information.

I also see a few PW audit records without any value for the Remote Address
field. Perhaps some of these other fields will help you determine what is
going on. The complete list of violation types can be found in Appendix F
of the Security Reference manual.

Seq   Field             Text
  10  PWTSTP            Timestamp of entry
  20  PWRADR            Remote address
  30  PWTYPE            P-Pwd, U-User name, A-APPC, D-DST user, E-
  40  PWJOB             Name of job
  50  PWUSER            Name of user
  60  PWNBR             Number of job
  70  PWPGM             Name of program
  80  PWUSPF            User profile
  90  PWRPORT           Remote port
 100  PWDEVN            Device name

Ed Fishel,
edfishel-r/[email protected]

_______________________________________________
This is the Security Administration on the AS400 / iSeries (Security400) mailing list
To post a message email: Security400-Zwy7GipZuJhWk0Htik3J/[email protected]
To subscribe, unsubscribe, or change list options,
visit: http://lists.midrange.com/mailman/listinfo/security400
or email: Security400-request-Zwy7GipZuJhWk0Htik3J/[email protected]
Before posting, please take a moment to review the archives
at http://archive.midrange.com/security400.