VMS AUDIT LOG

[Sk Noorul Hassan]

Hi,

I am getting the following information in audit log of one of the vms server VAX111.

"2-APR-2009 12:58:55.09 LOGFAIL NETWORK VAX111 ILLEGAL 00084EF3"

What does this ILLEGAL mean?

[Volker Halle · Accepted solution]

Hi,

the string 'ILLEGAL' is the local username used for the attempted DECnet network access.

Check your DECnet object (or session control application) database for this username.

As far as I remember, this string could be used to protect the TASK object from remote default access.

Volker.

[Hein van den Heuvel]

The word ILLEGAL appears in the columns between nodename and ID where typically the username appears. That's what the ANAL/AUDI column headers indicate, That's what the data on my system looks like.

Do you have any reason to believe that 'ILLEGAL' is not simply a username?

Now on my 8.3 system, when I cause a LOGFAIL using an invalid (illegal?!) username that name is NOT displayed, but the text is used.

It would not surprise me if some earlier OpenVMS version reported the actually username which is not unlikely to be a fat-fingered password.

What OpenVMS version is being used? Considering the node name... V5.5-2 ?

Check out:
http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=1372502

Hein.

[Sk Noorul Hassan]

Thanks. I got it.

[Hein van den Heuvel]

Ah! now I remember. Volker is right of course. I was also right, in that is was a username.
I just did not see it on my system because I happened to have the task object enabled.

See for example : http://h71000.www7.hp.com/doc/73final/documentation/pdf/decnet_ovms_gd_network.pdf

The username used could be anything, but is by default establish as 'ILLEGAL' with the command

MCR NCP DEFINE OBJECT TASK NUMBER 0 USER ILLEGAL PASSWORD DISABLED

It can be verified with MCR NCP SHOW KNOWN OBJECTS

Hein.