Re: Determine how pwrdwnsys was executed

[Jim Franz <franz9000@xxxxxxxxx>]

we are exploring the I Access logon and any scripts, plus the .ws (I have
to pass on  to a network dept.)
I interviewed the user - and she really just signed on - then attempted to
exit the menu.
The menu itself does not link to other menus, but it does have a command
line (and user has limited capability=*no at the time - now *yes)). The
previous posted job log shows pwrdwnsys initiated from her interactive job.
Will see where the macro suggestion takes us..
Jim


On Wed, Jun 8, 2016 at 9:14 AM, Gerald Magnuson <gmagqcy.midrange@xxxxxxxxx>
wrote:

> something else that hasn't been mentioned yet....  if you look at the users
> .ws or .hod file on the PC...   does it have a signon macro?
>
> On Tue, Jun 7, 2016 at 1:18 PM, Jim Franz <franz9000@xxxxxxxxx> wrote:
>
> > Looking for clues to determine what happened.
> > V7R1 development system cume 15142
> > IBM iAccess for windows 7.1 latest svc pack
> >
> > What we know so far is that a user logged onto a development system (to
> do
> > some testing.
> > 1 minute later QHST log indicates PWRDWNSYS initiated by the user, but
> > users log (with 4 00 *seclvl and log CL *YES in jobd ) shows no command
> > line entry of any command. Her story is no menu options executed...
> >
> > No menu source shows pwrdwnsys or endsys (have searched for an api but
> not
> > found one). Aware of GO POWER menu but not found a menu to connect to
> this.
> > Message ID . . . . . . :   CPI0995       Severity . . . . . . . :
> > 00
> > Message type . . . . . :
> > Information
> > Date sent  . . . . . . :   06/07/16      Time sent  . . . . . . :
> > 11:01:49
> >
> >
> > Message . . . . :   PWRDWNSYS command issued with parameters
> > specified.
> > Cause . . . . . :   The Power Down System (PWRDWNSYS) command was
> requested
> > by
> >   job 477963/XXXXX/BS7515C with the following parameters
> > specified:
> >     -- How to end
> > *IMMED
> >     -- Delay time
> > 3600
> >     -- Restart options
> > *NO
> >     -- IPL source
> > *PANEL
> >     -- End subsystem option
> > *DFT
> >     -- Timeout option
> > *CONTINUE
> >     -- Confirm
> > *ENVVAR
> >     -- Image catalog
> >
> > From job . . . . . . . . . . . :   QSYSARB4
> >   User . . . . . . . . . . . . :     QSYS
> >   Number . . . . . . . . . . . :     390670
> >
> > From program . . . . . . . . . :   QWCASDSM
> >
> >
> > Only other odd item is in user's job log, Image Catalogs on system
> unloaded
> > (CPCBC11) in 12 seconds prior to message about PWRDWNSYS (CPF0901) - I
> > would have expected "after".
> >
> > No packaged exit programs (have recommended previously..)
> > QAUDJRN is active - not sure how to see remote command...
> >
> > Auditing
> > options
> > *ATNEVT
> > *SECURITY
> > *PGMFAIL
> > *SAVRST
> > *AUTFAIL
> > *SERVICE
> > PC has been scanned
> >
> > Jim
> > --