topic Re: remotely monitor login alarm in OpenVMS in Operating System - OpenVMS

remotely monitor login alarm in OpenVMS

Loh Chi Tsung — Mon, 08 Sep 2008 08:23:14 GMT

Hi,

I'm not really an OpenVMS user... so any help would be really appreciated.

Recently, I have come across a security requirement from a customer which they want to have a centralized monitoring for any break in attempts. Currently they have 8 OpenVMS clusters.

Is there a way to direct redirect the security log to a remote server like a remote syslog functions in Unix/Linux ?

Thanks

Re: remotely monitor login alarm in OpenVMS

Wim Van den Wyngaert — Mon, 08 Sep 2008 09:02:15 GMT

Not to my knowledge. We do every x minutes an anal/aud/fu, parse the output and scp a file with "the events" to the windows security server. For SOX.

If you write a program you can directly read the audit events and pass them in real time to whatever you like. We have a fortran program that passes it to an inhouse monitoring system (not for SOX).

Wim

Re: remotely monitor login alarm in OpenVMS

Phil.Howell — Mon, 08 Sep 2008 09:32:49 GMT

There is a syslog client, however you will have to construct some program or script on the vms side to send the log message.
Alternatives are ...
Configure the vms HPSIM agents to send an SNMP trap (easier said than done).
Use the nagios nrpe agent to send a trap, this also will involve some scripting at the vms end.
I'm not sure where I got the syslog client, I will check tomorrow.
Phil

Re: remotely monitor login alarm in OpenVMS

Loh Chi Tsung — Mon, 08 Sep 2008 09:40:33 GMT

Hey Guys,

Thanks for the quick response.

I believe there are no off the shelf solution for this with out need of writing some scripts.

Thanks for the answer.

Cheers

Re: remotely monitor login alarm in OpenVMS

Loh Chi Tsung — Mon, 08 Sep 2008 09:41:51 GMT

Use of script to trigger the logs to remote server.

Re: remotely monitor login alarm in OpenVMS

Phil.Howell — Mon, 08 Sep 2008 22:57:44 GMT

the client is at
http://home.insightbb.com/~hemker/vms.html
there is also a syslog module in perl
(if the systems do perl)
Phil