Operating System - OpenVMS
cancel
Showing results for 
Search instead for 
Did you mean: 

Users accounting question

 
SOLVED
Go to solution
Darijo
Frequent Advisor

Users accounting question

How or where can I see which users were logged on the machine lately?

Thank you!
11 REPLIES 11
Jim_McKinney
Honored Contributor

Re: Users accounting question

Presuming that ACCOUNTING is enabled for your system you could just choose your date and...

$ ACCO/SUMM=(PROC,USER)/SINC=1-DEC-2008

marsh_1
Honored Contributor

Re: Users accounting question

hi,

for individual queries you can go into the sysuaf and check for the last interactive login field

$ set def sys$system
$ r authorize

there are also ways of producing reports from the uaf using dcl some examples of which are on dcl.openvms.org (which i can't seem to get to at the moment)

or if you have auditing enabled for login
then you can use anal/audit e.g

$ anal/audit/event=login/full

$ show audit (to see settings)

$ set audit/audit/enable=(login=all) (to change settings)

there are also entries in the sys$manager:operator.log for telnet login etc

take time to read the vms users , security and system managers essentials guides on the vms documentation site here to give you a good background on what is possible and the implications of using the various tools available :-

http://h71000.www7.hp.com/doc/os83_index.html

hope this helps

Hein van den Heuvel
Honored Contributor

Re: Users accounting question

Typically folks use the LAST_LOGIN time from SYSUAF to report who use the system.

Just GOOGLE for +LAST_LOGIN +SYSUAF for several examples.

Here is a starting point I wrote last year if you wanted to roll your own:

$!
$! uaf_lastlogin.com Hein van den Heuvel,August 2007.
$
$! List records from SYSUAF for which the Last Interactive Login is more
$! than 'p1' days ago (default 90).
$
$IF p1.eqs."" THEN p1 = "90"
$cutoff_date = f$cvtime("TODAY -''p1'-")
$!libr/extr=$uafdef/out=uafdef.tmp sys$library:lib.mlb
$!sea uafdef.tmp flag...
$!EQU UAF$Q_LASTLOGIN_I 396
$!EQU UAF$L_FLAGS 468
$!EQU UAF$V_DISACNT 4
$
$!define sysuaf sys$disk:[]sysuaf.dat ! Local copy for testting
$sysuaf = f$parse("SYSUAF","SYS$SYSTEM:.DAT",,,"SYNTAX_ONLY")
$open /read/share=write uaf 'sysuaf'
$loop:
$ read/end=done uaf rec
$ lastlogin_bin = F$EXTR(396,8,rec)
$ lastlogin_asc = F$FAO("!%D",f$cvui(32,32,f$fao("!AD",8,lastlogin_bin)))
$ IF f$cvtime(lastlogin_asc) .GTS. cutoff_date THEN GOTO loop
$ IF f$cvsi(468*8+4,1,rec) THEN GOTO loop ! disuser already?
$ username = F$EXTRACT(4,12,rec)
$ WRITE SYS$OUTPUT "MODIFY ''username' /FLAG=DISUSEER ! Last Login: ", lastlogin_asc
$ GOTO loop
$done:
$close uaf


hth,
Hein.
Darijo
Frequent Advisor

Re: Users accounting question


OUTPUT:

From: 19-DEC-2008 00:00 VMS Accounting Report To: 19-DEC-2008 14:48Process type Username Total
Records
-----------------------------------
INTERACTIVE SYSTEM 2
NETWORK AECSYS 189
NETWORK FAL$SERVER 1


Thanks, but I also need IP addresses...
marsh_1
Honored Contributor
Solution

Re: Users accounting question

hi ,

try
$ sear sys$manager:operator.log/win=(2,0)/out=nnn.tmp "login "
then

$ sear nnn.tmp/win=(0,2) "whatever date"