Monitoring users

[Guest.Visitor]

Hi, I would like to start monitoring when users log in / out of the system and build up some history of their ' activities'. I would also like to know if they get the password wrong, disable the user etc etc at log in time. Is this possible? TIA Carl

[nycsusan@hotmail.com]

I would also like to know if they get the password wrong, disable the user etc etc at log in time. That information is stored in the user profile. DSPOBJD to an outfile and you can query the outfile for *DISABLED and invalid password attempts. This can be put in a CL to create a report daily or however often you wish.

[Guest.Visitor]

Carl, Take a look at the security audit journal. Audit entries can be written each time a job starts, someone logs in, and when an invalid password is used. See Chapter 9 and Appendix F of the Security Reference manual. Ed Fishel

[Guest.Visitor]

Carl, Do a WRKSYAVAL and type '5' next to QAUDLVL (Security auditing level) then press Enter. Then hit F1 (Help) to see everything that can be audited. Chris

[J.Panzenhagen]

Call me unsophisticated, but you can get this information from the system log. Use the DSPLOG command for the period you desire and specify the message ids you would like to see. You can send the log to *PRINT which you could then copy to a file to query. The message ids you may need are: CPF1124 - Job started (Log in) CPF1164 - Job ended (Log out) CPF1393 - User profile disabled CPF1397 - Workstation disabled CPF2234 - Bad password entered. Additionally you could create a message queue QSYS/QSYSMSG. If this message queue exists, the OS will write the CPF1393 and CPF1397 messages to it. I don't know what other messages are sent here, but I know that their are others. HTH John Panzenhagen

[Guest.Visitor]

I monitor QSYS/QSYSMSG regularly, here are the messages I routinely see: CPF1397 Subsystem .... varied off work station .... for user .... CPF1393 Subsystem .... disabled user profile .... on device .... CPI96C0 Protected password could not be validated. CPI96C4 Password not correct for user profile. CPF1269 Program start request received on communications device .... was rejected with reason codes .... CPI96C3 Message CPF22E4 returned on system call. (meaning... password has expired) Some very important messages: CPI099C Critical storage lower limit reached CPF0907 Serious storage condition may exist. CPI1161 Unit ... with device parity protection not fully operational. CPI1165 One or more device parity protected units still not fully operational. CPI1166 Units with device parity protection fully operational. Hope I don't see any new messages, cuz whatever it is, it is sure to be bad news.

[Guest.Visitor]

In the midst of a CL program I discovered it is not easy or obvious how to retrieve the workstation message queue name of a given user knowing only their logon name and what jobs they have running. The command RTVUSRPRF will not retrieve this info, at least not in version 3.7. Several other commands will retrieve various info,but the name of the workstation message queue a given user is assigned by virtue of their logon location at the time cannot be easily found out. The ASSIST menu allows break messages to be sent, but conceals how it determines where the user currently is working. The source for this menu is not available, so I can't look at it. HELP. I'm Stumped. Tom Kayser