topic Re: Monitoring a logical change in Operating System - OpenVMS

Monitoring a logical change

Shael Richmond — Wed, 18 Jan 2006 12:01:11 GMT

Is there anyway to monitor when a logical name changes?

I found the set security/class=logical_name_table lnm$system_table.

But that doesn't really work. It gives too much information and doesn't tell me what I really need - it doesn't list the actual logical name that was changed.

Any suggestions?

Re: Monitoring a logical change

Robert_Boyd — Wed, 18 Jan 2006 14:14:20 GMT

Unless the interlock mechanism has been refined further in recent releases, the locks on logical names are at a high level. In order to change a logical name the whole table is locked for the duration of the change. I'd be surprised if you could track it at the logical name level short of putting breakpoints on the memory locations where the logical name is stored. Maybe one of the internals gurus can suggest other possibilities.

Robert

Re: Monitoring a logical change

Robert Gezelter — Wed, 18 Jan 2006 14:15:27 GMT

Shael,

Check the list of events that can be monitored by the Audit Server (I would look right now, but something I was waiting for just finished).

- Bob Gezelter, http://www.rlgsc.com

Re: Monitoring a logical change

Jim_McKinney — Wed, 18 Jan 2006 14:27:47 GMT

You should be able to audit for write access only. If this isn't adequate then you might consider isolating the logical name in a table of its own that you define into LNM$FILE_DEV.

Re: Monitoring a logical change

Shael Richmond — Wed, 18 Jan 2006 14:41:11 GMT

No I couldn't find a class other then logical_name_table.

I did set security for write access but that generates a lot of audit messages and I still can't tell which logical name was changed.

It looks like I didn't miss anything unfortunated!

Thanks

Re: Monitoring a logical change

BR878588 — Thu, 19 Jan 2006 02:08:14 GMT

Any reason why you can't put the critical logical(s) into its (their) own specific table and set auditing on that specific table? If an audit event were to happen then you could translate the names and see what had changed.

Don't forget to protect write access to the table with ACLs.

Re: Monitoring a logical change

Ian Miller. — Thu, 19 Jan 2006 05:36:34 GMT

If your VMS version is recent enough there is the LNM SDA extension which traces logical name activity?

Are you trying to debug something or is this some sort of audit requirement?