Operating System - OpenVMS
cancel
Showing results for 
Search instead for 
Did you mean: 

VMS AUDIT LOG

 
SOLVED
Go to solution
Sk Noorul Hassan
Regular Advisor

VMS AUDIT LOG

Hi,

I am getting the following information in audit log of one of the vms server VAX111.

"2-APR-2009 12:58:55.09 LOGFAIL NETWORK VAX111 ILLEGAL 00084EF3"

What does this ILLEGAL mean?
4 REPLIES 4
Volker Halle
Honored Contributor
Solution

Re: VMS AUDIT LOG

Hi,

the string 'ILLEGAL' is the local username used for the attempted DECnet network access.

Check your DECnet object (or session control application) database for this username.

As far as I remember, this string could be used to protect the TASK object from remote default access.

Volker.
Hein van den Heuvel
Honored Contributor

Re: VMS AUDIT LOG


The word ILLEGAL appears in the columns between nodename and ID where typically the username appears. That's what the ANAL/AUDI column headers indicate, That's what the data on my system looks like.

Do you have any reason to believe that 'ILLEGAL' is not simply a username?

Now on my 8.3 system, when I cause a LOGFAIL using an invalid (illegal?!) username that name is NOT displayed, but the text is used.

It would not surprise me if some earlier OpenVMS version reported the actually username which is not unlikely to be a fat-fingered password.

What OpenVMS version is being used? Considering the node name... V5.5-2 ?

Check out:
http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=1372502

Hein.
Sk Noorul Hassan
Regular Advisor

Re: VMS AUDIT LOG

Thanks. I got it.
Hein van den Heuvel
Honored Contributor

Re: VMS AUDIT LOG

Ah! now I remember. Volker is right of course. I was also right, in that is was a username.
I just did not see it on my system because I happened to have the task object enabled.

See for example : http://h71000.www7.hp.com/doc/73final/documentation/pdf/decnet_ovms_gd_network.pdf

The username used could be anything, but is by default establish as 'ILLEGAL' with the command

MCR NCP DEFINE OBJECT TASK NUMBER 0 USER ILLEGAL PASSWORD DISABLED

It can be verified with MCR NCP SHOW KNOWN OBJECTS

Hein.