RE: What IP was being used by a devd?

["Flensburg, Carsten" <Flensburg@xxxxxxxxxx>]

Another option would be the system audit journal. If the audit journal
is setup to include job data (QAUDCTL *AUDLVL, QAUDLVL *JOBDTA) the job
initiation process will deposit audit journal entries (code T) of type
JS which includes the remote address of the device starting the job.
Here's an example of how that would work:

                         Display Journal Entry Details                  
                                                                        
 Journal  . . . . . . :   QAUDJRN         Library  . . . . . . :   QSYS 
                                                                        
 Sequence . . . . . . :   785125                                     
 Code . . . . . . . . :   T  - Audit trail entry                        
 Type . . . . . . . . :   JS - Job data                                 
                                                                        
 Trigger  . . . . . . :   No                                            
 Program  . . . . . . :   QWTPIIPP                                      
   Library  . . . . . :     QSYS                                        
   ASP device . . . . :     *SYSBAS                                     
 System sequence  . . :   10565805659011719168                          
 Thread identifier  . :   000000000000000E                              
 Receiver . . . . . . :   AUDJRN2705                                    
   Library  . . . . . :     QGPL                                        
   ASP device . . . . :     *SYSBAS                                     
 Journal identifier . :   X'00000000000000000000'                       
 Remote address . . . :   10.249.58.212                                 
 Address family . . . :   IPv4


Using the RCVJRNE command or the QjoRetrieveJournalEntries API you can
then monitor and retrieve journal entries as they arrive in the journal
receiver. And using the DSPJRN command you can also investigate earlier
events for as long as the available journal receiver range covers.

-----Original Message-----
From: midrange-l-bounces@xxxxxxxxxxxx
[mailto:midrange-l-bounces@xxxxxxxxxxxx] On Behalf Of Bruce Vining
Sent: 21. maj 2010 03:17
To: Midrange Systems Technical Discussion
Subject: Re: What IP was being used by a devd?

The signon program approach provides the "catch everything" solution.
The
Job Notify exit runs asynchronous to the initiated job. For a very short
lived job, the exit program may not get control in time to catch the IP
address (admittedly a low probability occurence, but possible all the
same).

This communication is intended only for use by the addressee.It may contain confidential or privilegedinformation.
If you receive this communication unintentionally, please inform us immediately and delete this e-mail and any attachments. 
Warning: Although we have taken reasonable precautions to ensure no viruses are present in this email, we cannot accept
responsibility for any loss or damage arising from the use of this email orattachments.