trapping source of invalid login attempts

[Rich Herdman <rherdman@xxxxxxxxx>]

Does any information like source IP, etc get logged in the system 
security journals when a user attempts a login and fails?  We have one 
of our user profiles that is getting disabled every morning on one of 
our partitions and we are having trouble tracking down who/what/where 
these attempts are coming from. 

All of our iSeries are behind our firewall and the account in question 
has been used for program-to-program automation for many years 
(interactive use is disabled), so we assume there is an older version of 
a program out there trying to connect with an old password (which are 
changed regularly).

Any suggestions? 

Rich Herdman
Sysco