Ana/Audit Question

[Jack Trachtman]

(I can't figure this out from the manual!)

An ANA/AUDIT/FULL/EVENT=LOGFAIL display contains lines labeled "Username:" and "User record:". I can select for "Username" via
/SEL=USERNAME=whatever.

How can I match on the "User record:" entry?

TIA

[Hoff]

Can you post up a copy of the record where you're seeing this field with your ANALYZE /AUDIT /EVENT=LOGFAIL command? (I don't have that field visible within the command output I've just looked at from an OpenVMS Alpha V8.3 system. Which means I'm probably not looking in the same spot as you are, or I don't have the same LOGFAIL entries in the local SECURITY.AUDIT$JOURNAL database.)

[Jack Trachtman]

Attached is example Ana/Aud display

[Jess Goodman · Accepted solution]

Ok, that output would not from an ANALYZE/AUDIT with /EVENT=LOGFAIL. You would get it with /EVENT=SYSUAF.

But to answer your question, back in the VMS 6.2 documention you will find these /SELECT keywords:

UAF_ADD
UAF_COPY
UAF_DELETE
UAF_MODIFY
UAF_RENAME
UAF_SOURCE

They are still accepted with ANAL/AUDIT /SELECT- but they are no longer documented. I believe the reason for this is they never worked the way they should. Instead of fixing the bugs in this feature they just hid the feature.

But see if this works for you:

$ ANALYZE/AUDIT /FULL/EVENT=SYSUAF -
/SELECT=UAF_SOURCE=REVKAH

[Hoff]

The other obvious question is: what are you up to here, in general terms? There may well be an alternative solution. (There was an interesting approach toward repelling ssh dictionary attacks posted out in c.o.v. recently, for instance.)

[Jack Trachtman]

My bad.

The ANA/AUDIT interactive display is just not intuitively obvious to me, so I was using it incorrectly.

Thanks for the help - it gave me the insight to see my error.