Need to find out who ran a command

[jmcnelis]

Here at work, we use Tivoli Workload Scheduler 7.0. The other night, someone set a job from priority 0 to priority 10, when said job was not supposed to be set to 10. It caused quite a problem with our client. We are now in the process of trying to find out who sent this command. Our Maestro admin said that the only info he could get from the log was:

BATCHMAN:04:38/#S970946/Operator command: ALTPRI
BATCHMAN:04:38/JOB=SAPSSP_100#LAST_WORKDAY_CF.SMA_SALES_PERIOD_OPEN;10

Now, I am in no way an expert on this software, having never used it before starting to work here. My question is, is there a way to find out what ID ran this command, either via AIX or Tivoli logs, or are we out of luck? Thanks in advance for any help in this matter! We're hoping to save the job of one of our night guys.

Joey

 

[fredericrenaud]

If you have your auditing enabled, check in your $MAESTRO_HOME/audit directory and you'll see 2 sub-directories, one for the plan (conman) and the other for the database (composer). Go in either plan/database and look at the date the command was run. The information should be there.

If it's disabled and you want to have it for the next time, you can enable the audit by modifying globalopts and set these two flags to 1:

Database audit level =1
Plan audit level =1

Requires TWS v7.0 or above.