topic Audit$Journal Offline Storage and Retrieval in Operating System - OpenVMS

Audit$Journal Offline Storage and Retrieval

William VanDalsem — Mon, 10 Oct 2005 16:51:03 GMT

I need to use FTP and put a close audit$journal onto an IBM Zos system for tape storage and retrieval, if needed.

I have been unable to identify the correct OpenVMS and Zos FTP settings to get this to work. The Zos system is using IBM's standard FTP server software.

Any help would be appreciated.

Re: Audit$Journal Offline Storage and Retrieval

John Gillings — Mon, 10 Oct 2005 20:36:48 GMT

William,

It depends on how much processing you're prepared to perform either in putting the file into storage, or retrieving it.

Audit journal files are variable length, which few non-OpenVMS FTP servers can deal with appropriately. So, the simplest way to make sure you get all your data back intact is to change the file to FIXED 512 byte records before sending. Send it in IMAGE mode. When you retrieve the file, restore the file attributes before analysis.

Note, we're not CONVERTing the file, just changing the file attributes to a lowest common denominator format that even the dumbest FTP implementation should understand.

Here's a procedure to adjust the file, and create a "fix" procedure for when it's retrieved (beware of wrapping):

$ IF p1.EQS."" THEN INQUIRE p1 "File"
$ rfm=F$FILE_ATTRIBUTES(p1,"RFM")
$ mrs=F$FILE_ATTRIBUTES(p1,"MRS")
$ lrl=F$FILE_ATTRIBUTES(p1,"LRL")
$ SET FILE/ATTRIBUTES=(RFM:FIX,MRS:512,LRL:512) 'p1'
$ dev=F$PARSE(p1,,,"DEVICE")
$ dir=F$PARSE(p1,,,"DIRECTORY")
$ nam=F$PARSE(p1,,,"NAME")
$ fix=dev+dir+"FIX_"+nam+".COM"
$ CREATE/FDL=SYS$INPUT 'fix'
RECORD
FORMAT STREAM_LF
$ OPEN/APPEND out 'fix'
$ WRITE out -
"$ SET FILE/ATTRIBUTES=(RFM:''rfm',MRS:''mrs',LRL:''lrl') ''p1'"
$ CLOSE out

In practice, I expect the record format and MRS to be constant for all audit journal files, but a bit of generality doesn't hurt.

Another possibility is to pack the file into a BACKUP saveset before transferring it, as it's always possible to repair a saveset.

There are implementations of ZIP and UNZIP that can preserve OpenVMS file attributes, but I've never found one that works 100% of the time for all files and through any sequence of operating systems, file systems, browswers etc.

Re: Audit$Journal Offline Storage and Retrieval

Ian Miller. — Tue, 11 Oct 2005 03:31:10 GMT

If you backup the file this will create a file with fixed length records (8k by default). ftp the file with the binary or image option. When you retrieve the file it will be set to fixed length 512 byte records. The backup saveset has the correct record length recorded in it. Use on of the DCL procedures available to fix the backup save set eg. http://h71000.www7.hp.com/freeware/freeware70/000tools/reset_backup_saveset_file_attributes.com

say the usual curse about stupid unix file transfer protocols and you're done :-)

Re: Audit$Journal Offline Storage and Retrieval

Joseph Huber_1 — Wed, 12 Oct 2005 12:09:17 GMT

If Yone wants to avoid all the file-structure pre- and post-processing, then archive ZIP for VMS is the best solution, and You get a big save in archive space.

ZIP_CLI/VMS archive.zip list of files

The /VMS option (or "-V" in Unix syntax) stores the VMS file attributes for later UNZIP operations.

Re: Audit$Journal Offline Storage and Retrieval

Joseph Huber_1 — Thu, 13 Oct 2005 07:04:57 GMT

Regarding Johns remark of ZIP/UNZIP not working sometimes:

I never found such combinations since many years. At least the actual versions (Zip 2.31, Unzip 5.52) are doing well.

I tested with security audit files (actually I do this in my weekly cleanup job), and Anal/audit on such zipped/unzipped audit log files does not show a problem. The mean compression ratio is 90% .