topic Tracing Earlier FTP activity to user/process in Operating System - OpenVMS

Tracing Earlier FTP activity to user/process

comarow — Tue, 09 Jan 2007 12:51:12 GMT

I'm sure I'm missing something obvious, but I"m not that used to Multinet as opposed to TCPIP.

How can I go back and trace who did FTP activites during the day? In my case, looking
back at use earlier in the day.

Re: Tracing Earlier FTP activity to user/process

Jim_McKinney — Tue, 09 Jan 2007 14:06:16 GMT

By default...

Outbound? you can't unless you've got image accounting enabled.

Inbound? each successful connection results in the creation of a FTP_SERVER.LOG file in the users' home directory - of course there's nothing to prevent the users from having deleted these (and they are also potentially governed by an logical name imposed version limited). You could scan for these.

With the current version of MultiNet you could enable the session accounting logger for FTP (see Ch 18 of the Admin Guide). I've never used it but it purports to be able to keep a log of both client and server sessions.

You could also set a security alarm on the associated executables.

Re: Tracing Earlier FTP activity to user/process

Richard Whalen — Tue, 09 Jan 2007 15:02:03 GMT

The first reply does a very good job of listing the options.

The session accounting that is available in MultiNet FTP logs the following information at the end of each FTP session:
USERNAME, local and remote IP addresses, # files sent, # files received, KBytes sent, KBytes received, start and end time.