topic Re: Excluding records from an analyze/audit in Operating System - OpenVMS

Excluding records from an analyze/audit

Chris Barratt — Tue, 04 Oct 2005 23:30:12 GMT

I need to do an analyze/audit/summary/event_type=(breakin,logfail) but would like to exclude a particular remote source.

I had hoped that the /noselect qualifier would accept the same fields as the /select qualifier (eg /select=remote=ident=blah), but it doesn't seem to work that way. I must admit, the documentation didn't lead me to believe that it would, but I thought I'd give it a go (I couldn't really see a use for a plain "/noselect" qualifier).

So, does anyone else have any ideas on how to do this using the analyze/audit command.

I know I can do it with a program, or by parsing the output of 2 commands (one for the whole and one for just the device in question) and munging figures. I'm just trying to get out of more work than is absolutely necessary.

Thanks,
Chris

Re: Excluding records from an analyze/audit

Chris Barratt — Tue, 04 Oct 2005 23:31:29 GMT

oh, I forgot to add... OpenVMS 7.3-2

Re: Excluding records from an analyze/audit

Karl Rohwedder — Wed, 05 Oct 2005 00:48:10 GMT

Chris,

have you tried the /IGNORE qualifier? It accepts the same criteria as the /SELECT, but excludes those records.

regards Kalle

Re: Excluding records from an analyze/audit

Chris Barratt — Wed, 05 Oct 2005 00:57:30 GMT

Doh !
Thanks Kalle.

Re: Excluding records from an analyze/audit

Chris Barratt — Wed, 05 Oct 2005 00:58:25 GMT