topic Re: off server logging facility in Operating System - OpenVMS

off server logging facility

Tim Nelson — Thu, 09 Mar 2006 12:21:46 GMT

I saw a reference or two to having VMS report it's system events to a syslog server. It initially looks like it is not possible.
Here is my requirment and hopefully there are some ideas.

It is required that all system events be logged to a tertiary server. The administrators of the primary server cannot have admin privelages to modify the events recorded on the tertiary server.

The above is somewhat the purpose of a centralized syslog server where each server will send log events to and have reviewed by a different party.

Any ideas for the VMS world ? I see there is a syslog daemon available for VMS but getting all of vms to tie into the logger utility may not be possible.

Thanks to all !!

Re: off server logging facility

Arch_Muthiah — Thu, 09 Mar 2006 12:35:06 GMT

Tim,

SYSLOG server freeware exists for OpenVMS, specifically
a syslogd server is available via the FileServ package.

Archunan

Re: off server logging facility

Uwe Zessin — Thu, 09 Mar 2006 13:17:43 GMT

I don't think that helps Tim. I beleive he wants the CLIENT functionality in VMS: the VMS system sends events (operator requests, error log entries, DECnet events, IP events, ...) via |syslog| protocol to another system.

Re: off server logging facility

Tim Nelson — Thu, 09 Mar 2006 14:33:59 GMT

Uwe has the idea.

Audit is requiring system events to be mirrored or logged "off" server. Although the syslog daemon that is ported from UNIX to VMS serves this purpose the next hurdle would be getting VMS to send it's events through the logger command.

If reply/enable could be told to send the messages into the logger command, that might be a way around it.
or
Write DLC to monitor the operator.log and then send each new entry through logger.
or
I see that the reply command will allow for op messages to another node. This might be easiest but the other node would have to be a VMS server admin'd/controlled by another group.

Re: off server logging facility

Bill Hall — Thu, 09 Mar 2006 15:35:09 GMT

Tim,

I would assume that a requirement of this type would have some "budget dollars" behind it. I recommend looking at ConsoleWorks from TDI <>. Very good product and good people to work with. You have your choice of the usual popular server platforms including VMS. We use it to connect to, monitor and archive the output on serial consoles all around North America. We also send alarms based on "events" that come across consoles. We don't use their syslog or Windows client, but they are available for ConsoleWorks also.

Bill

Re: off server logging facility

Phillip Thayer — Thu, 09 Mar 2006 16:29:22 GMT

Tim,

I have also used Consoleworks at a couple of different sites and it works well. It will allow you to log anything that would normally come across theconsole. Including if someone logs in on the console and does some work. It can be set to watch for specific text strings and trigger events based off the text strings. I also would recommend it.

Phil

Re: off server logging facility

John Gillings — Thu, 09 Mar 2006 16:40:29 GMT

Tim,

Not SYSLOG, but check the section "Using a Remote Log File" in "HP OpenVMS Guide to System Security" - it gives a worked example of sending all AUDIT messages to a remote system (using DECnet). The remote file is a second audit journal.

If the SYSLOG thing doesn't already exist, there are mechanisms which would simplify creating a SYSLOG client - use an audit listener mailbox (also in the Guide to System Security a few pages beyond the remote log example). It's just a matter of writing a little program to catch the audit messages from the mailbox, reformat them as SYSLOG packets and toss them out on the wire for the SYSLOG server. (I'd be astonished if someone hasn't already done this).

Re: off server logging facility

Ian Miller. — Thu, 09 Mar 2006 17:22:24 GMT

which events are to be sent?

Re: off server logging facility

Robert Gezelter — Thu, 09 Mar 2006 19:04:22 GMT

Tim,

I have done this for one of my clients, who had a similar need.

A lot depends on what precisely you are monitoring. There are ways to capture OPCOM and the AUDIT Event streams. It takes some care, but works quite well.

- Bob Gezelter, http://www.rlgsc.com

Re: off server logging facility

Robert Atkinson — Fri, 10 Mar 2006 04:06:58 GMT

I'd recommend IAM:Consoles from Itheon (www.itheon.com).

Like ConsoleWorks, it traps events coming out of OPA0 and can send them via a number of methods, including SNMP, PAGE, EMAIL, TNG, etc.

It's very useful for creating DCL scripts to reply to or act upon OPCOM requests or messages.

Rob.

Re: off server logging facility

Tim Nelson — Fri, 10 Mar 2006 08:49:17 GMT

Thanks for the ideas.

I will research each of these.

One item that we aleady have in place that I did not realize was we are using a PC with PowerTerm for the consoles. Log console output to a log file for each server.

Much thanks again.

Tim