Job QCMNARB02

[mmaschke]

Hallo,
im Systemprotokoll tauchen immer mal wieder folgende Nachrichten auf:
Sitzung für Einheit QPADEV0003 normal beendet
Beschreibung für Einheit QPADEV0003 geändert.
Sitzung für Einheit QPADEV0003 normal beendet
Beschreibung für Einheit QPADEV0003 geändert.
Diese Sitzung kommt vom Job QCMNARB02
Von Job . . . . . . . . . . . : QCMNARB02
Benutzer . . . . . . . . . . : QSYS
Nummer . . . . . . . . . . . : 194523

Dies passiert mehrmals hintereinander und so 2 bis 3 mal am Tag.
Dabei wird der Bildschirmtyp QPADEV0003 von 3477 auf V100 geändert.
Wird die Einheit QPADEV0003 gerade benutzt nimmt der Job QCMNARB02 eine andere Einheit.
Kann mir jemand sagen was dies für ein Job ist.
Wir haben V5R3

Manfred Maschke

[TARASIK]

Hallo,
das ist ein Systemjob. Hier etwas erklärt: --> http://www.redbooks.ibm.com/redbooks/pdfs/sg242161.pdf
QCMNARB System Value Setting
Work that was done in the QSYSARB system job for APPC is moved out of
QSYSARB and into communications arbiter jobs. These communications
arbiters start when the system is IPLed. They are named QCMNARB01 through
QCMNARB12.
There is one QCMNARBnn job per processor on the system. For example, on a
12-way processor, there are jobs named QCMNARB01 through QCMNARB12.
The exception is that single processor systems have QCMNARB01 and
QCMNARB02.
In addition, the APPN automatic creation, deletion, and vary on and off
processing of APPN controllers and devices that was done by the QLUS system
job is now performed in the communications arbiter jobs.
Note:
Throughout this chapter, the reference to APPN controllers and devices
indicates objects created when the APPC controllers and devices indicate
APPN(*YES).
The QCMNARB system value specifies the number of communications arbiter
jobs that are available to process APPC communications. The QCMNARB
setting can affect the performance at startup, takedown, and during error
recovery for APPC communications and APPN autoconfiguration. The first time
an APPC controller is varied on after an IPL, it is assigned to a communication
arbiter job. On systems with many APPC controllers and devices, more
QCMNARB jobs can result in improved APPC communication performance.
If QCMNARB is set to zero, the system functions as systems prior to V4R2. That
is, the work is performed in QSYSARB and QLUS, not in the communication
arbiters.
Recommendation
Set the QCMNARB system value to a non-zero setting. It is also acceptable
to leave it at the default value of *CALC, which typically results in a non-zero
setting.
On multi-processor systems, a setting of *CALC results in one communication
arbiter job for each processor on the system.
The system maintains a count of objects for each QCMNARB job and attempts to
assign controllers to the communication arbiter job that is serving the
least
number of objects. This balances the amount of work that each QCMNARBnn
arbiter job must perform. All devices that are attached to an APPC controller
are serviced by the arbiter job to which the controller is assigned.
To determine which communication arbiter is assigned to a particular APPC
controller, use the Display Controller Description (DSPCTLD) command and
locate the QCMNARBnn system job that handles recovery for that controller and
its devices. An example is shown in Figure 54 on
page
183.



Display Controller Description
SYSTEMXX
02/27/98 20:27:22
Controller description . . . . . . : CTLD CTLD0001
Option . . . . . . . . . . . . . . : OPTION *BASIC
Category of controller . . . . . . : *APPC
Link type . . . . . . . . . . . . : LINKTYPE *LAN
Online at IPL . . . . . . . . . . : ONLINE *YES
Character code . . . . . . . . . . : CODE *EBCDIC
Maximum frame size . . . . . . . . : MAXFRAME 16393
Current maximum frame size . . . . : 521
Remote network identifier . . . . : RMTNETID SYSTEMSXP
Remote control point . . . . . . . : RMTCPNAME SYSTEMDMT
Initial connection . . . . . . . . : INLCNN *DIAL
Dial initiation . . . . . . . . . : DIALINIT *LINKTYPE
Switched disconnect . . . . . . . : SWTDSC *NO
Data link role . . . . . . . . . . : ROLE *NEG
LAN remote adapter address . . . . : ADPTADR 08005A202722
LAN DSAP . . . . . . . . . . . . . : DSAP 04
LAN SSAP . . . . . . . . . . . . . : SSAP 04
Autocreate device . . . . . . . . : AUTOCRTDEV *ALL
System job . . . . . . . . . . . . : QCMNARB01
Text . . . . . . . . . . . . . . . : TEXT AUTOMATICALLY CREATED BY SYSTEM
Press Enter to continue. Bottom
F3=Exit F11=Nondisplay keywords F12=Cancel


Figure 54. Communication
Arbiter Job
Assigned to the
Controller
If there are APPC controllers that have non-APPC devices attached to them, the
recovery for that controller and its devices continue to execute in QSYSARB.
The same applies to V4R2 systems. That is, only APPC controllers with APPC
devices attached take advantage of the multiple communication arbiters function.

[Fuerchau]

V100 wird z.B. verwendet, wenn man per Telnet von außen (PC/Linux) zugreifen will.
Interessant wäre dann ob entsprechend dieser Zeit eine gültige Anmeldung an diesem Terminal erfolgt.

[mmaschke]

Zwischen geändert und beendet liegen immer 10 Sekunden.

[mmaschke]

Ich habe den Job gefunden.
Bei dieser Steuereinheit sind alle QPDEV... Bildschirme hinterlegt.

Jetzt ist nur die Frage warum wird dort öfters ein Bildschirm geändert und dann beendet.


Steuereinheitenbeschreibung . . . : QPACTL01
Auswahl . . . . . . . . . . . . . : *BASIC
Steuereinheitenkategorie . . . . . : *VWS

Bei IPL anhängen . . . . . . . . . : *YES
Systemjob . . . . . . . . . . . . : QCMNARB02
Nachrichtenwarteschlange . . . . . : *SYSVAL
Akt. Nachrichtenwarteschlange . . : QSYSOPR
Bibliothek . . . . . . . . . . . : QSYS
Text . . . . . . . . . . . . . . . : Steuereinheit für xxxxxxxx erstellt.

[Fuerchau]

immer dann, wenn von TELNET ein Terminal angefordert wird, generiert dieser Job ein Terminal oder verwendet ein vorhandenes freies.
Je nach angefordertem Typ und Tastaturcode (Codepage des Terminals) muss das Terminal den Anforderungen angepasst werden.
Die 5250 ist ein erweitertes TELNET, dass Typ und ggf. Namen mitgibt.
Wenn also V100 (einfaches ASCII-Terminal VT100) angefordert wird deutet dies auf eine simple TELNET-Sitzung hin.
In diesem Fall würde ich hier auf einen Einbruchsversuch tippen.

Im Moment habe ich keinen Telnet-Client mehr in Windows 8.1, aber ggf. kannst du das ja mal ausprobieren.

[mmaschke]

Genau ich habe von meinem PC eine Telnet Sitzung aufgebaut und es wurde ein QPDAEV Bildschirm geöffnet.
Er ist auch wieder auf Typ V100 geändert worden.
Ich konnte mich normal anmelden.
Ich nehme jetzt an das derjenige oder irgendein PC-Programm versucht sich anzumelden, aber über keinen richtigen Benutzer verfügt und daran scheitert.
Es sind 5 Anmeldeversuche bei der AS400 möglich.
Es wäre nun schön herauszufinden wer oder was versucht sich anzumelden.

[Fuerchau]

Da musst du etwas Aufwand betreiben.
Über den Systemwert QRMTSIGN kannst du ein Programm hinterlegen (Aufrufparameter musst du mal suchen). Dann noch ein paar API's (gibt's auch hier im Forum) um die IP des Anforderers zu ermitteln.

[TARASIK]

Hallo,
die einfachste Möglichkeit:
Once device descriptions have been created on your system, you can turn QAUTOCFG and QAUTOVRT system values off during normal operations. This enables you to toggle on and off when you have new devices to configure. This restricts anyone else from Telneting to your system from DOS or other command prompt.

[TARASIK]

Hallo,
hier noch ein interessanter Artikel:

Getting Control Over Telnet Connections

I am always amazed at how easy it is to establish a Telnet connection with another system. Just open a command box on your PC and enter the TELNET command along with the IP address of the system you want to connect to. On most IBM i boxes, you’ll get the familiar signon screen and as long as you have a legitimate user profile and password, you’re in business. I recently had a IT manager ask me to connect to their system to do some diagnostic work. They gave me what appeared to be very secure instructions to obtain a sign-on screen from a web-based applet. I followed their instructions and ended up connecting and getting the work done. When I was finished, on a whim, I tried a direct Telnet connection to their system and got through without a hassle. Their IP address was provided through the web-based application sign-on process which was a significant weakness of that in my book as well.
In earlier tips about getting control over IP server functions, I recommended just shutting off the server function if you use it sparingly or not at all. Unfortunately, Telnet does not fall into this category. IBM i Access uses it to establish emulation sessions and most other legitimate methods for establishing a terminal session end up going through the Telnet server. So, if you shut off Telnet, you’ll be shooting yourself in the foot.
The good news is that there are several things that you can do to get control over how Telnet sessions are issued on your system. The first big step you can take is to turn of automatic configuration of virtual devices. For terminal sessions, these are the pesky QPADEVnnnn sessions that you may be familiar with already. You do this by updating the system value of QAUTOVRT to zero.
Before you do that, check your system to see if there are active sessions using one of these device names. If so, then you’ll have to contact the users that are coming in with these device names and get their terminal session configurations updated to use a known device name.
Concurrent with this, you will also have to deactivate automatic device configuration. Without taking this step, anyone can configure a new device name by just using it in a new configuration. The first time they sign-on, the system will generate the required device description for them. You can shut this off by updating the system value QAUTOCFG to zero (off).
Once you’ve made these changes, you should then go through your system and manually remove any QPADEVnnnn devices that have already been created and used on your system. You can view all of these by going to the OS menu named CFGVRT and running option #3 or just run the following command:
WRKDEVD DEVD(*VRTDSP)
This will display all of the virtual display devices on your system, just check those with names that start with the QPADEV.
While you’re making these changes, it would also be a good idea to check the system value QAUTORMT. This should also be set to zero (off) to help assure a secure system.
Some of your people may rely on automatic device configuration when new devices are attached to your system, and that’s probably still OK. But, it doesn’t happen every day in most shops which is a good reason to keep it turned off most of the time. When you need automatic device configuration, you can activate it for a few minutes as needed and then shut it off again.

[Pikachu]

Sieh dir mal den Ausgangspunkt QIBM_QTG_DEVINIT an.

[mmaschke]

QAUTOVRT und QUATOCFG stehen auf 0.
Leider müssen wir ein paar QPADEV Bildschirme wegen einer Fremdsoftware (Lohn und Gehalt) haben.
Diese Bildschirme kann ich nicht löschen.
Und TELNET benutzt dann auch QPADEV.