Strange Changed System Value's traceable? - IBM AS400

This is a discussion on Strange Changed System Value's traceable? - IBM AS400 ; Hi! I have an strange case, when I look into the QHST-log I can see that a lot's System Value's has been changed from an specific QPADEVXXXX device and with an specific USRPRF even the job nr. but when i ...

+ Reply to Thread
Results 1 to 2 of 2

Thread: Strange Changed System Value's traceable?

  1. Strange Changed System Value's traceable?

    Hi!
    I have an strange case, when I look into the QHST-log I can see that a
    lot's System Value's has been changed from an specific QPADEVXXXX
    device and with an specific USRPRF even the job nr. but when i look at
    the time range for the changes it's only takes 2 seconds for 27 System
    Values to change no one can change this values so fast and when I
    talked to the person he know nothing about it.
    When I checked the Joblog for the QPADEVXXXX at this specific time I
    only see

    CPC2205 Completion 00 10/26/07 22:03:51.529072
    QSYUP QSYS 0E46 QSECCFGS QSYS 00E0
    Message . . . . : User profile
    QSYSOPR changed.
    CPC2205 Completion 00 10/26/07 22:03:51.856192
    QSYUP QSYS 0E46 QSECCFGS QSYS 00E3
    Message . . . . : User profile
    QPGMR changed.
    CPC2205 Completion 00 10/26/07 22:03:51.893720
    QSYUP QSYS 0E46 QSECCFGS QSYS 00E6
    Message . . . . : User profile
    QUSER changed.
    CPC2205 Completion 00 10/26/07 22:03:51.917640
    QSYUP QSYS 0E46 QSECCFGS QSYS 00E9
    Message . . . . : User profile
    QSRV changed.
    CPC2205 Completion 00 10/26/07 22:03:51.940400
    QSYUP QSYS 0E46 QSECCFGS QSYS 00EC
    Message . . . . : User profile
    QSRVBAS changed.
    CPF0001 Escape 30 10/26/07 22:04:14.274760
    QCADRV2 QSYS 04AA QCMDCHK QSYS 0119

    What can have caused this changes?
    Where can I check to get more info?
    BR


  2. Re: Strange Changed System Value's traceable?

    It would appear that the user signed on to that interactive session
    had performed a request to either CALL QSYS/QSECCFGS or CFGSYSSEC command.
    That program is shipped with *PUBLIC *EXCLUDE, and any command issued
    to which the user was authorized to perform would be able to complete;
    since the user could access that program, presumably the profile has
    SPCAUT(*ALLOBJ).

    http://publib.boulder.ibm.com/infoce...gsysseccmd.htm
    http://publib.boulder.ibm.com/infoce.../cfgsyssec.htm
    http://publib.boulder.ibm.com/infoce...sysseccust.htm
    http://publib.boulder.ibm.com/infoce...olsecurity.htm

    Regards, Chuck
    --
    All comments provided "as is" with no warranties of any kind
    whatsoever and may not represent positions, strategies, nor views of my
    employer

    ake wrote:
    > I have an strange case, when I look into the QHST-log I can see that
    > lots of System Values have been changed from an specific QPADEVXXXX
    > device and with an specific USRPRF even the job nbr. but when i look at
    > the time range for the changes it only takes 2 seconds for 27 System
    > Values to change no one can change this values so fast and when I
    > talked to the person he know nothing about it.
    > When I checked the Joblog for the QPADEVXXXX at this specific time I
    > only see
    >
    > CPC2205 Completion 00 10/26/07 22:03:51.529072
    > QSYUP QSYS 0E46 QSECCFGS QSYS 00E0
    > Message . . . . : User profile QSYSOPR changed.
    > <>
    > CPF0001 Escape 30 10/26/07 22:04:14.274760
    > QCADRV2 QSYS 04AA QCMDCHK QSYS 0119
    >
    > What can have caused this changes?
    > Where can I check to get more info?


+ Reply to Thread