Operating System - OpenVMS
cancel
Showing results for 
Search instead for 
Did you mean: 

Ana/Audit Question

SOLVED
Go to solution
Jack Trachtman
Super Advisor

Ana/Audit Question

(I can't figure this out from the manual!)

An ANA/AUDIT/FULL/EVENT=LOGFAIL display contains lines labeled "Username:" and "User record:". I can select for "Username" via
/SEL=USERNAME=whatever.

How can I match on the "User record:" entry?

TIA
5 REPLIES
Hoff
Honored Contributor

Re: Ana/Audit Question

Can you post up a copy of the record where you're seeing this field with your ANALYZE /AUDIT /EVENT=LOGFAIL command? (I don't have that field visible within the command output I've just looked at from an OpenVMS Alpha V8.3 system. Which means I'm probably not looking in the same spot as you are, or I don't have the same LOGFAIL entries in the local SECURITY.AUDIT$JOURNAL database.)
Jack Trachtman
Super Advisor

Re: Ana/Audit Question

Attached is example Ana/Aud display
Jess Goodman
Esteemed Contributor
Solution

Re: Ana/Audit Question

Ok, that output would not from an ANALYZE/AUDIT with /EVENT=LOGFAIL. You would get it with /EVENT=SYSUAF.

But to answer your question, back in the VMS 6.2 documention you will find these /SELECT keywords:

UAF_ADD
UAF_COPY
UAF_DELETE
UAF_MODIFY
UAF_RENAME
UAF_SOURCE

They are still accepted with ANAL/AUDIT /SELECT- but they are no longer documented. I believe the reason for this is they never worked the way they should. Instead of fixing the bugs in this feature they just hid the feature.

But see if this works for you:

$ ANALYZE/AUDIT /FULL/EVENT=SYSUAF -
/SELECT=UAF_SOURCE=REVKAH
I have one, but it's personal.
Hoff
Honored Contributor

Re: Ana/Audit Question

The other obvious question is: what are you up to here, in general terms? There may well be an alternative solution. (There was an interesting approach toward repelling ssh dictionary attacks posted out in c.o.v. recently, for instance.)
Jack Trachtman
Super Advisor

Re: Ana/Audit Question

My bad.

The ANA/AUDIT interactive display is just not intuitively obvious to me, so I was using it incorrectly.

Thanks for the help - it gave me the insight to see my error.