Tracing a background job IP

[Former Member]

Hi Gurus,

There was a background job"BIDTPR_22604_1" that was run by the user which has made some undesirable changes in the server.

Now we need to track who ran this background job.

But the problem is that the user is generic and is used by a lot of people.

Also the t-code "STAD" is noy giving any output.

Please update how to track the user on the basis of IP.

Thanks and regards

Sandeep.

[jurjen_heeck]

> Now we need to track who ran this background job.

> But the problem is that the user is generic and is used by a lot of people.

I think finding out when the job was scheduled is going to be your biggest challenge......

[Former Member]

When a job runs in the background, where is the frontend?

Probably what you meant is who scheduled the job and who released it and who last changed a jobstep in it before it was released...?

Try SM37, unless it was subsequently deleted. But there are ways of finding this as well.

Cheers,

Julius

[Former Member]

Hi,

Some BI records were deleted andduring execution of this background job "BIDTPR_22604_1" was run.

The Job was run time is 15:30:29,but since the user is generic ,we are unable to pinpoint the user.

We need to find the IP used for this background job execution.

Please update

Thanks

Sandeep.

[Former Member]

> We need to find the IP used for this background job execution.

Okay, one last attempt...

If a generic SYSTEM user ID was in the jobstep when it executed in the background, then who was the scheduler of the job and released it in the foreground prior to it running? Check the job log in SM37.

If the job has been deleted, then it will be more tricky, but can be done as well.

Cheers,

Julius

[sdipanjan]

If you have a idea of the time range of the Job that deleted the records, you can go on searching the details of User who scheduled or changed at different interval and also the user id whose authorization was used during the execution of steps.

TBTCP, TBTCS etc.

Regards,

Dipanjan

[Former Member]

If i understood your question correctly, some one logged on with a generic ID and scheduled/processed a job and now you want to find out which terminal the user has logged on from........correct ?

Get the time stamp of when the job was processes and look up the audit log (transaction sm20) for that time stamp.

From here you will know which terminal was used to logon using that generic id at that particular time stamp.

hope this helps!

[Former Member]

This message was moderated.

[Former Member]

Are you still at your PC following this thread, or have you gone into the background?

[jurjen_heeck]

> Are you still at your PC following this thread, or have you gone into the background?

You can't trace him?

[Former Member]

I think he has gone back into the kitchen, to help Merv Grazinski make a sandwich...

[jurjen_heeck]

I must admit to using google on that one and had a good laugh!

[Former Member]

Hi,

Please update how to track the user on the basis of IP.

TRy...

Table USR41 stores the IPs with user names and machine names etc temporarily only.

Otherwise run report RSSTAT200 for chking details...

Thanks

Ramakrishna.