Operating System - OpenVMS
cancel
Showing results for 
Search instead for 
Did you mean: 

Excluding records from an analyze/audit

SOLVED
Go to solution
Chris Barratt
Frequent Advisor

Excluding records from an analyze/audit

I need to do an analyze/audit/summary/event_type=(breakin,logfail) but would like to exclude a particular remote source.

I had hoped that the /noselect qualifier would accept the same fields as the /select qualifier (eg /select=remote=ident=blah), but it doesn't seem to work that way. I must admit, the documentation didn't lead me to believe that it would, but I thought I'd give it a go (I couldn't really see a use for a plain "/noselect" qualifier).

So, does anyone else have any ideas on how to do this using the analyze/audit command.

I know I can do it with a program, or by parsing the output of 2 commands (one for the whole and one for just the device in question) and munging figures. I'm just trying to get out of more work than is absolutely necessary.

Thanks,
Chris
4 REPLIES
Chris Barratt
Frequent Advisor

Re: Excluding records from an analyze/audit

oh, I forgot to add... OpenVMS 7.3-2
Karl Rohwedder
Honored Contributor
Solution

Re: Excluding records from an analyze/audit

Chris,

have you tried the /IGNORE qualifier? It accepts the same criteria as the /SELECT, but excludes those records.

regards Kalle
Chris Barratt
Frequent Advisor

Re: Excluding records from an analyze/audit

Doh !
Thanks Kalle.
Chris Barratt
Frequent Advisor

Re: Excluding records from an analyze/audit

.