HPE Community read-only access December 15, 2018
This is a maintenance upgrade. You will be able to read articles and posts, but not post or reply.
Hours:
Dec 15, 4:00 am to 10:00 am UTC
Dec 14, 10:00 pm CST to Dec 15, 4:00 am CST
Dec 14, 8:00 pm PST to Dec 15, 2:00 am PST
Operating System - OpenVMS
cancel
Showing results for 
Search instead for 
Did you mean: 

Ana/Audit Question

 
SOLVED
Go to solution
Jack Trachtman
Super Advisor

Ana/Audit Question

(I can't figure this out from the manual!)

An ANA/AUDIT/FULL/EVENT=LOGFAIL display contains lines labeled "Username:" and "User record:". I can select for "Username" via
/SEL=USERNAME=whatever.

How can I match on the "User record:" entry?

TIA
5 REPLIES
Hoff
Honored Contributor

Re: Ana/Audit Question

Can you post up a copy of the record where you're seeing this field with your ANALYZE /AUDIT /EVENT=LOGFAIL command? (I don't have that field visible within the command output I've just looked at from an OpenVMS Alpha V8.3 system. Which means I'm probably not looking in the same spot as you are, or I don't have the same LOGFAIL entries in the local SECURITY.AUDIT$JOURNAL database.)
Jack Trachtman
Super Advisor

Re: Ana/Audit Question

Attached is example Ana/Aud display
Jess Goodman
Esteemed Contributor
Solution

Re: Ana/Audit Question

Ok, that output would not from an ANALYZE/AUDIT with /EVENT=LOGFAIL. You would get it with /EVENT=SYSUAF.

But to answer your question, back in the VMS 6.2 documention you will find these /SELECT keywords:

UAF_ADD
UAF_COPY
UAF_DELETE
UAF_MODIFY
UAF_RENAME
UAF_SOURCE

They are still accepted with ANAL/AUDIT /SELECT- but they are no longer documented. I believe the reason for this is they never worked the way they should. Instead of fixing the bugs in this feature they just hid the feature.

But see if this works for you:

$ ANALYZE/AUDIT /FULL/EVENT=SYSUAF -
/SELECT=UAF_SOURCE=REVKAH
I have one, but it's personal.
Hoff
Honored Contributor

Re: Ana/Audit Question

The other obvious question is: what are you up to here, in general terms? There may well be an alternative solution. (There was an interesting approach toward repelling ssh dictionary attacks posted out in c.o.v. recently, for instance.)
Jack Trachtman
Super Advisor

Re: Ana/Audit Question

My bad.

The ANA/AUDIT interactive display is just not intuitively obvious to me, so I was using it incorrectly.

Thanks for the help - it gave me the insight to see my error.