Operating System - OpenVMS
cancel
Showing results for 
Search instead for 
Did you mean: 

Tracing Earlier FTP activity to user/process

 
SOLVED
Go to solution
comarow
Trusted Contributor

Tracing Earlier FTP activity to user/process

I'm sure I'm missing something obvious, but I"m not that used to Multinet as opposed to TCPIP.

How can I go back and trace who did FTP activites during the day? In my case, looking
back at use earlier in the day.

2 REPLIES
Jim_McKinney
Honored Contributor
Solution

Re: Tracing Earlier FTP activity to user/process

By default...

Outbound? you can't unless you've got image accounting enabled.

Inbound? each successful connection results in the creation of a FTP_SERVER.LOG file in the users' home directory - of course there's nothing to prevent the users from having deleted these (and they are also potentially governed by an logical name imposed version limited). You could scan for these.

With the current version of MultiNet you could enable the session accounting logger for FTP (see Ch 18 of the Admin Guide). I've never used it but it purports to be able to keep a log of both client and server sessions.

You could also set a security alarm on the associated executables.
Richard Whalen
Honored Contributor

Re: Tracing Earlier FTP activity to user/process

The first reply does a very good job of listing the options.

The session accounting that is available in MultiNet FTP logs the following information at the end of each FTP session:
USERNAME, local and remote IP addresses, # files sent, # files received, KBytes sent, KBytes received, start and end time.