topic Re: Ana/Audit Question in Operating System - OpenVMS

Ana/Audit Question

Jack Trachtman — Tue, 23 Sep 2008 14:48:27 GMT

(I can't figure this out from the manual!)

An ANA/AUDIT/FULL/EVENT=LOGFAIL display contains lines labeled "Username:" and "User record:". I can select for "Username" via
/SEL=USERNAME=whatever.

How can I match on the "User record:" entry?

TIA

Re: Ana/Audit Question

Hoff — Tue, 23 Sep 2008 17:49:41 GMT

Can you post up a copy of the record where you're seeing this field with your ANALYZE /AUDIT /EVENT=LOGFAIL command? (I don't have that field visible within the command output I've just looked at from an OpenVMS Alpha V8.3 system. Which means I'm probably not looking in the same spot as you are, or I don't have the same LOGFAIL entries in the local SECURITY.AUDIT$JOURNAL database.)

Re: Ana/Audit Question

Jack Trachtman — Tue, 23 Sep 2008 19:07:59 GMT

Attached is example Ana/Aud display

Re: Ana/Audit Question

Jess Goodman — Tue, 23 Sep 2008 20:06:50 GMT

Ok, that output would not from an ANALYZE/AUDIT with /EVENT=LOGFAIL. You would get it with /EVENT=SYSUAF.

But to answer your question, back in the VMS 6.2 documention you will find these /SELECT keywords:

UAF_ADD
UAF_COPY
UAF_DELETE
UAF_MODIFY
UAF_RENAME
UAF_SOURCE

They are still accepted with ANAL/AUDIT /SELECT- but they are no longer documented. I believe the reason for this is they never worked the way they should. Instead of fixing the bugs in this feature they just hid the feature.

But see if this works for you:

$ ANALYZE/AUDIT /FULL/EVENT=SYSUAF -
/SELECT=UAF_SOURCE=REVKAH

Re: Ana/Audit Question

Hoff — Tue, 23 Sep 2008 22:19:44 GMT

The other obvious question is: what are you up to here, in general terms? There may well be an alternative solution. (There was an interesting approach toward repelling ssh dictionary attacks posted out in c.o.v. recently, for instance.)

Re: Ana/Audit Question

Jack Trachtman — Tue, 23 Sep 2008 22:29:51 GMT

My bad.

The ANA/AUDIT interactive display is just not intuitively obvious to me, so I was using it incorrectly.

Thanks for the help - it gave me the insight to see my error.