Understanding IBM i Command Source for Password Expiration Monitoring
If you're diving into system administration or custom command creation on IBM i, you've probably bumped into the need to monitor things like password expirations. Today, we're reviewing a simple but useful command source example called PWDEXPMON. This is the command definition that sets up a "Password Expiration Monitor" tool. It's a great starting point for learning how to build your own commands.
What is This Command For?
In a nutshell, PWDEXPMON is designed to scan user profiles on your IBM i system and flag any passwords that are about to expire within a specified number of days. The example code here is just the command prompt source (the .CMD file), which defines the interface users see when they call the command. It doesn't include the actual program logic that does the monitoring, that would be in a separate CL or RPG program attached via the CMD's PGM parameter (which isn't shown here).
Think of this as the "front door" to a utility that helps admins stay ahead of password issues, avoiding lockouts or security gaps. Usage is straightforward: you run PWDEXPMON DAYS(7) to check for expirations in the next week.
Breaking Down the Command Source Code
Let's look at the provided code. This is written in the IBM i command definition language, which you compile with the CRTCMD (Create Command) command.
Here's the code again for reference:
/* Command: PWDEXPMON - Password Expiration Monitor */
/* Description: Monitors user profiles for expiring passwords */
/* */
/* Parameters: */
/* DAYS - Number of days to look ahead for expiring passwords */
/* */
/* Usage Examples: */
/* PWDEXPMON DAYS(7) - Check for passwords expiring in next 7 days */
/* PWDEXPMON DAYS(14) - Check for passwords expiring in next 14 days */
/* */
/* Modification History: */
/* v.001 2026.02.03 - Nick Litten - Created */
/* -------------------------------------------------------------------------- */
CMD PROMPT('Password Expiration Monitor')
This is classic IBM i command source. It starts with a big comment block for documentation, which is a best practice. Always include purpose, parameters, examples, and history, it makes maintenance easier down the road.
The CMD Statement:
CMD PROMPT('Password Expiration Monitor')This declares the command itself. The PROMPT keyword sets the text that appears when you prompt the command with F4. It's user-friendly and descriptive. Without this, the prompt would just show the command name.
The PARM Statement:
This parameter defines the time period for which password expirations will be checked.
PARM KWD(PERIOD)Attribute | Meaning |
|---|---|
| The keyword name used when running the command (e.g., |
| The parameter is a character string. |
| It can hold up to 6 characters. |
| Default value is |
| Defines valid special values the user can choose: |
| Allows the parameter to accept an expression (for example, a variable or CL expression). |
| The text shown on the command prompt screen — helps users understand what the parameter does. |
This parameter defines where the report will be written in the IBM i Integrated File System (IFS).
PARM KWD(IFSPATH)
|
|---|
When you compile this with CRTCMD CMD(PWDEXPMON) SRCFILE(YOURLIB/QCMDSRC) PGM(*LIBL/YOURPGM), it creates an executable command object.
The PGM parameter points to the actual program (e.g., a CLLE module) that receives the DAYS value and does the work, like using DSPUSRPRF or SQL to query password expiration dates.
Strengths of This Command Design
- Simplicity: One parm keeps it easy to use. Defaults to 7 days, which is practical.
- Flexibility: MIN(0) allows edge cases, like finding already expired passwords.
- Documentation: The header comment is thorough, including examples and history. This is gold for team environments.
- IBM i Native: Leverages built-in security features without reinventing the wheel.