Tracking IP Address for Invalid Sign-On Attempts

Resolving The Problem

Security journal QAUDJRN exists . . . . . :  YES    
Current QAUDCTL system value  . . . . . . :  *AUDLVL
Current QAUDLVL system value  . . . . . . :  *AUTFAIL                                                        

SELECT JOB_NAME,
       JOB_USER,
       DATE(ENTRY_TIMESTAMP) AS ENTRY_DATE,
       TIME(ENTRY_TIMESTAMP) AS ENTRY_TIME,
       DEVICE_NAME,
       VIOLATION_TYPE,
       VIOLATION_TYPE_DETAIL,
       AUDIT_USER_NAME,
       REMOTE_ADDRESS
    FROM TABLE (
            SYSTOOLS.AUDIT_JOURNAL_PW(
                STARTING_TIMESTAMP => TIMESTAMP('2026-05-01-00.00.01'), ENDING_TIMESTAMP => TIMESTAMP('2026-05-07-08.30.00'))
        ) AS PW;

• The user profile associated with the invalid sign-on attempt is listed in the AUDIT_USER_NAME column.
• The User ID shown in the JOB_USER column represents the user profile under which the system job is running and performing the authentication request. It is not the User Profile that is being disabled.
• The value 'P' in the VIOLATION_TYPE column indicates that an Invalid Password was used. 
• The value 'U' in the VIOLATION_TYPE column indicates that an Invalid User profile ID was used.
• The value 'Q' in the VIOLATION_TYPE column indicates that a sign-on attempt (user authentication) failed because the user profile is disabled.
• For descriptions of other VIOLATION_TYPE values, refer to Appendix F of the Security Reference Manual 

Investigation Steps After Identifying a Source IP Address

Once a source IP address has been identified from password-related audit journal entries, the following steps should be taken to investigate and remediate the issue.

1. Identify the Source of the Connection

• Use the source IP address (REMOTE_ADDRESS) to determine the origin of the invalid sign-on attempt. This may involve identifying whether the address is internal or external and correlating it with known systems, application servers, middleware, or user workstations.

2. Analyze the Job Information

Review the associated JOB_NAME to help identify the type of connection involved.

Examples include:

• QINTER: Indicates a 5250 interactive session.
• QZSOSIGN: Indicates a host server sign-on job, commonly associated with application or remote access services.
• QZLSFILE or QZLSFILET: Identifies a NetServer sign‑on attempt associated with access through a mapped network drive or SMB/CIFS file share.

This information helps determine whether the failed authentication was user-initiated or application-driven.

3. Special Case: Loopback Address (127.0.0.1)

• If the source IP address is 127.0.0.1, the issue typically originates from local services on the system rather than an external source.
• This situation commonly occurs when a user changes a password while an active HTTP or application session continues to run using cached credentials. Repeated authentication attempts using the old password can result in the user profile being disabled.

4. Resolving Loopback-Related Password Failures (HTTP Services)

To resolve issues caused by cached credentials in HTTP services, perform the following steps:

1. End the HTTP administrative server:

   ENDTCPSVR *HTTP HTTPSVR(*ADMIN)

2. Verify that all administrative HTTP jobs have ended:

   WRKACTJOB SBS(QHTTPSVR)

   Ensure that all Admin server jobs (for example, Admin1 through Admin5) have terminated.

3. Restart the HTTP administrative server:

   STRTCPSVR *HTTP HTTPSVR(*ADMIN)

This process clears cached authentication data so that subsequent connections use the updated password.

CPYAUDJRNE ENTTYP(PW) OUTFILE(yourlib/QAUDIT)

CPYAUDJRNE ENTTYP(PW) JRNRCV(*CURCHAIN) FROMTIME('date' 'time') TOTIME('date' 'time') OUTFILE(yourlib/QAUDIT)

SELECT PWJOB,
       PWUSER,
       PWNBR,
       PWPGM,
       PWUSPF,
       PWRPORT,
       PWRADR,
       PWESDL,
       PWTYPE,
       PWUSRN,
       PWTSTP
    FROM yourlib/qauditpw

CRTLIB TESTLIB

CRTDUPOBJ OBJ(QADSPJR5) FROMLIB(QSYS) OBJTYPE(*FILE) TOLIB(TESTLIB) NEWOBJ(IP)

DSPJRN JRN(QAUDJRN) ENTTYP(PW) OUTPUT(*OUTFILE) OUTFILFMT(*TYPE5) OUTFILE(TESTLIB/IP)

SELECT PWJOB,
       PWUSER,
       PWNBR,
       PWPGM,
       PWUSPF,
       PWRPORT,
       PWRADR,
       PWESDL,
       PWTYPE,
       PWUSRN,
       PWTSTP
    FROM TESTLIB/IP