Have you examined if session is being established via a script ? I suspect
a script is using a specific password inside the script or pointing to
somewhere else location on the system.  Once the password being used is
found, you can update TSM server to match this.

I would examine cron job on the AIX machine by issuing cron -l
Perhaps looking at the list, you can pick out a script.   To help you nail
down, one could examine TSM activity for a patten and look specifically
time period for this in con.

It is also possible the cronjob is running as a user.  In that case you
would need to sudo to that user and perform cron -l to see what is running
under that user name.

Sung Y. Lee

"ADSM: Dist Stor Manager" <ADSM-L AT VM.MARIST DOT EDU> wrote on 06/15/2005
03:39:17 PM:

> I am getting the following messages over and over on the server activity
> log.
> 06/15/05 10:44:10     ANR0407I Session 82797 started for administrator
> VIEW
>                        (AIX) (Tcp/Ip 129.255.105.43(56096)). (SESSION:
> 82797)
> 06/15/05 10:44:10     ANR0418W Session 82797 for administrator VIEW
> (AIX) is
>                        refused because an incorrect password was
> submitted.
>                        (SESSION: 82797)
>
> 06/15/05 10:44:10     ANR0405I Session 82797 ended for administrator
> VIEW (AIX).
>                        (SESSION: 82797)
>
> 06/15/05 10:44:10     ANR0407I Session 82798 started for administrator
> VIEW
>                        (AIX) (Tcp/Ip 129.255.105.43(56097)). (SESSION:
> 82798)
> 06/15/05 10:44:10     ANR0418W Session 82798 for administrator VIEW
> (AIX) is
>                        refused because an incorrect password was
> submitted.
>                        (SESSION: 82798)
>
> 06/15/05 10:44:10     ANR0405I Session 82798 ended for administrator
> VIEW (AIX).
>                        (SESSION: 82798)
>
>
> I opened a pmr with IBM and was told I could delete the VIEW admin
> account but this would only change the type of message in the act log.
> They also said if passwordaccess=generate on the TSM client node
> 129.255.105.43, then I could log in manually with the VIEW account and
> the password would get reset.  He said to login to the client in
> question and login to the TSM server using dsmc, which I did.  I was not
> prompted for a password so I did a QUERY NODE which asked me for a user
> and password.  I put in VIEW and the password and got the results of
> query node, but no messages went away.  I do not know how to log into
> TSM from a client as when I issue dsmc I am in.  The support person
> didn't seem to know how to either and told me to stop the automated
> process using the VIEW account and could not provide me with how to
> determine what that process might be or how to stop or start it.
>
> I did issue set authentication off and then I started getting messages
> in the activity log that indicated administrator VIEW was issuing QUERY
> STGPOOL and QUERY DRMEDIA.
>
> Does anyone know how to get the passwords for this one administrator
> VIEW in sync?
>
>
> Ila Z. Miller
> ___________________________________________________________
> ___________________________________________________________
> Health Care Information Systems
> University of Iowa Hospitals & Clinics
> ila-miller AT uiowa DOT edu
> Phone:  319.356.0067
> FAX: 319.356.3521
>
> Notice: This e-mail (including attachments) is covered by the Electronic
> Communications Privacy Act, 18 U.S.C. 2510-2521, is confidential and may
> be legally privileged.  If you are not the intended recipient, you are
> hereby notified that any retention, dissemination, distribution, or
> copying of this communication is strictly prohibited.  Please reply to
> the sender that you have received the message in error, then delete it.
> Thank you.