Re: Audit Journal Entry

["Angus MacQueen" <amacqueen@xxxxxxxxx>]

Thanks to all for replies, I was aware that client server programs ran under
QUSER I had never considered that a password change through the GUI would
appear in the audit journal against QUSER.

Thanks again

Angus

On 01/03/07, rob@xxxxxxxxx <rob@xxxxxxxxx> wrote:
> Client server programs often run underneath dummy IBM profiles like QUSER.
> Then they'll use the profile handles to get into the real user.  So, you
> need to NOT look at the job user to determine the user, but that other
> part.  And I think it logs that in the journal entry also.
> For example, if you do a WRKOBJLCK ANGUS *USRPRF (providing ANGUS is your
> user id) you may see several of these locks by jobs with job users like
> QUSER out there.  But really they were Client Server sessions set up via
> NetServer, etc.
>
> Rob Berendt
> --
> Group Dekko Services, LLC
> Dept 01.073
> PO Box 2000
> Dock 108
> 6928N 400E
> Kendallville, IN 46755
> http://www.dekko.com
>
>
>
>
>
> "Angus MacQueen" <amacqueen@xxxxxxxxx>
> Sent by: midrange-l-bounces@xxxxxxxxxxxx
> 03/01/2007 10:30 AM
> Please respond to
> Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxx>
>
>
> To
> midrange-l@xxxxxxxxxxxx
> cc
>
> Fax to
>
> Subject
> Audit Journal Entry
>
>
>
>
>
>
> Can anyone explain the circumstances where the QUSER profile might be
> responsible for changing a USRPRF?
>
> We have a piece of software that monitors the audit journal and if
> necessary
> logs an alert by email, sms, and/or to a console and I want to consider
> whether to exclude this alert if the profile is QUSER.
>
> This is an example of the alert I get:-
>
> Event message . . . . . :  CP - User Profile FERNJ changed by QUSER.
>
> User profile  . . . . . :  FERNJ
> Job . . . . . . . . . . :  687789/QUSER/QZSOSIGN
>
> TIA
>
>
> Angus
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.
>
>
> --
> This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing
> list
> To post a message email: MIDRANGE-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/midrange-l
> or email: MIDRANGE-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/midrange-l.