iSeries NetServer

[Arapahoe County]

Has anyone ever had this happen: The other day our Netserver was ended. Looing at the job log it showed that QSECOFR started ending jobs such as QZLSFILET, QZLSFILE, and QZLSSERVER, which once that job was ended , the netserver went down. Now, looking at the user profile QSECOFR, the previous sign-on was weeks before this happened to our Netserver, so I don't understand how the profile QSECOFR could have ended the jobs under the QSERVER subsystem and eventually shut down the NetServer. A couple of examples below from QHST log:

Job 168511/QPGMR/QZLSSERVER was ended by user QSECOFR.
All prestart jobs are ending for program QZLSFILET in QSYS.
Job 168515/QUSER/QZLSFILET was ended by user QSECOFR.
Job 208298/QUSER/QZLSFILE was ended by user QSECOFR.
Job 776449/QUSER/QZLSFILE was ended by user QSECOFR.
Job 508138/QUSER/QZLSFILE was ended by user QSECOFR.
Job 508139/QUSER/QZLSFILE was ended by user QSECOFR i5/OS Support for Windows Network Neighborhood (i5/OS NetServer) QACSD400 end

We are running i5/OS V6R1M1, which yes, I know, is no longer supported. We are on the latest and LAST cumme and all current hypers and group PTF's. After 25 years working on this platform, I have never seen this happen before where the user profile identified was the one that ended these jobs, even though the QSECOFR profile had not been used to sign on prior to this event happening.

I have found no embedded code that might have used the QSECOFR profile in order to being down our NetServer. In order to end these jobs, one HAD to have signed on with QSECOFR, yet the previous sign on listed on that profile was way before the day this Netserver went down.

Thoughts????

Dave

[john.sev99]

I'm not sure, but it is possible that when ending them via iNav, the jobs may run under the QSECOFR profile. It should be easily testable.

[tomliotta]

I'd look through the audit journal for entries up to a minute or so before those jobs ended. (Assuming you're auditing job activity...) You should see the JS entries for the ending of those jobs; and within some seconds before those, you'll probably see entries from jobs named something like "QYPSJSVR". Those will be Management Central jobs, and most of those likely run under the QSECOFR profile. If you don't see any QYP* job activity, look for other system-type jobs that run under QSECOFR. It might be necessary to look into joblogs of possible jobs to see references you'll want.

It's not necessary to "sign on" for a profile to do work. Any batch job might be running under QSECOFR. Management Central seems like a good candidate for ending NetServer since it commonly does much of its work that way (i.e., as QSECOFR).

[EmmanuelW1]

The converse is also true: the last sign-on date for QSECOFR may be more recent than the last time the profile was used by a human to access the system.

Cheers,

Emmanuel