RE: Disabled User ID without a corresponding invalid sign-in

[Jim Hawkins <jhawkins@xxxxxxxxxxxx>]

Thank you Rob,



I got nothing from the journal history, I even added PW and SO to the list. We had a user that I know used the incorrect password on Friday enough times to get disabled, and that doesn't even show up.



I used *curchain. *first (date) and *last.



I did apply the latest Cume over the weekend, prior to that we were 1 back on v7.4.



I have rarely found a need for the journaling, and haven't really looked at it. So it may not be configured to capture this information, or I could be missing something in what I am doing .




Regards,

Jim Hawkins
Programmer Analyst
Interkal LLC
Kalamazoo, MI


If you're very current on OS and PTF's you can try the AF and CP entries at https://www.ibm.com/docs/en/i/7.4?topic=services-audit-journal-entry



If you're not too far behind you can try those same entries here:

https://www.ibm.com/docs/en/i/7.4?topic=services-display-journal-table-function

and get remote port, remote IP address, etc.