In the ESFLOG LSYS commands are being issued and then followed by ESF897.
Who is issuing this command and how do I fix it or turn it off?
8:29:49 ESF897 INVALID COMMAND
The LSYS command is issued upon entry into the menu system to determine if the user has the necessary authority to have the N and V options added to his main panel. This causes a security check for the user to be queued.
The security subtask determines that this user is entering the menu system for the first time and queues checks for all of the 'super user' resources in order to determine how to build the file and printer panels later.
One of these checks is for EXCMD which will give us the answer for LSYS authorization and affect the initial panel displayed. If the 'super user' checks are authorized we store that information so it does not do further file and printer checks on those panels. If they are not authorized, it takes note that they have been checked so that they wont be checked again unless the Spool task is recycled or a REINIT command is issued.
The 'invalid command' response is meant to indicate that the command is invalid for the individual entering it, or on whose behalf it was entered, in this case.
When LSYS is issued by the menu system the end user never sees an 'invalid command' response, it is logged per the MESSAGE statement definition or, by default, it is written to the ESFLOG.
Refer to the CA Spool R11.7 Customization Guide, Chapter 1, Security Issues for the complete discussion regarding security settings and Chapter 3, Initialization Parameter Statement Descriptions for MESSAGE settings.