topic Re: Modifying security audit journal location in Operating System - OpenVMS

Modifying security audit journal location

roose — Thu, 29 Jun 2006 02:41:48 GMT

Hi, I am trying to setup a test server using a clone of a production system disk. However, I am unable to startup this node as I have not restored the original disk containing the production system's audit journal (security.audit$journal) file.

When I am in minimum startup, I try to do the following command:

$ SET AUDIT/JOURNAL=SECURITY/DESTINATION=SYS$MANAGER:SECURITY.AUDIT$JOURNAL

But I am getting the following error:

%SET-F-NOCTRLMBX, audit server control mailbox assignment failed
-SYSTEM-F-IVDEVNAM, invalid device name

I try to start the audit server, but also see the error concerning the unavailable device:

$ set audit/server=start
%SET-I-NEWAUDSRV, identification of new audit server process is 0000082E
$
%%%%%%%%%%% OPCOM 29-JUN-2006 11:38:45.98 %%%%%%%%%%%
Message from user AUDIT$SERVER on FOOBAR
%AUDSRV-W-SYSJNLNAC, cannot access system audit journal SECURITY

%%%%%%%%%%% OPCOM 29-JUN-2006 11:38:45.98 %%%%%%%%%%%
Message from user AUDIT$SERVER on FOOBAR
%SYSTEM-F-IVBUFLEN, invalid buffer length

%%%%%%%%%%% OPCOM 29-JUN-2006 11:38:45.98 %%%%%%%%%%%
Message from user AUDIT$SERVER on FOOBAR
%AUDSRV-E-FATINITERR, fatal error during startup processing; automatic server re
start suppressed

Is there a workaround that I can do while in minimum startup so that I can move my audit journal to my system disk? So that once I startup normally, it will be able to create a new audit journal file and will be able to boot successfully.

Thanks in advance for your help.

Re: Modifying security audit journal location

Ian Miller. — Thu, 29 Jun 2006 03:17:33 GMT

You may need to to
$set audit/server=initiate
after
$set audit/server=start

Note that SYS$MANAGER:VMS$AUDIT_SERVER.DAT contains the settings for the audit server so if you deleted file parhaps the AUDIT SERVER would default to having the audit log on the system disk.

Re: Modifying security audit journal location

roose — Thu, 29 Jun 2006 03:31:25 GMT

Ian, will it still be okay to do the set audit/server=init when my set audit/server=start failed?

I am now away from the server, so I will only be able to try this tomorrow. If this does not work, I'll also try to delete the .DAT file you mentioned.

Thanks.

Re: Modifying security audit journal location

John Abbott_2 — Thu, 29 Jun 2006 04:06:02 GMT

I'm sure it's documented somewhere, but you can also do a more memorable

$ @SYS$SYSTEM:STARTUP AUDIT_SERVER

Which executes the two commands mentioned (with a wait in between).

Regards
John.

Re: Modifying security audit journal location

Karl Rohwedder — Thu, 29 Jun 2006 04:35:01 GMT

To have a clear starting point, may be you should:
- stop AUDIT_SERVER (SET AUDIT/SEVRER=EXIT)
- delete the VMS$AUDIT_SERVER.DAT
- restart AUDIT_SERVER (@STARUP AUDIT_SERVER)
- check it via SHOW AUDIT/ALL
- then redirect the journal via the command you mentioned

Note: the VMS$AUDIT_SERVER.DAT may be relocated with logical VMS$AUDIT_SERVER.

regards Kalle

Re: Modifying security audit journal location

Jan van den Ende — Thu, 29 Jun 2006 10:22:37 GMT

Roose,

while the advices given on DELETing VMS$AUDIT_SERVER (or its default in SYS$MANAGER), it might be wiser to just RENAME it. That also removes it logically, but it will still be available for later reference.

Just my EUR 0.02

Proost.

Have one on me.

jpe

Re: Modifying security audit journal location

roose — Fri, 30 Jun 2006 01:32:38 GMT

Hi all, thanks for your help. What I did was renamed the .DAT file, restart the system on minimum startup first, started audit server and then move the journal file's destination. Worked like a charm! :)