VMS Workstation Security Monitoring

[Joseph Huber_1]

To "route to a bigger machine", You mean just have the audit event sent, not written to a journal on that machine ? I doubt it is possible, except the documented /listener mailbox.

The operator messages are independent of audit journal or archive, they always are sent clusterwise from opcom.
Just don't have an operator log file started on all other nodes (the default anyway on workstations), and no OPCOM enabled terminals except the one wanted.

Setting the audit journal destination to a decnet address: I doubt it is possible, but hey : why don't You just test it and report what happens ?

[Ian Miller.]

If you want the audit information to go to another file in addition the audit log the look at HELP SET AUDIT/ARCHIVE

[Willem Grooters]

Indeed, all OPCOM will be sent, but enable just ONE OPER termnal for class SECURITY. No experience, just deducting: it will show security-related messages. /ARCHIVE could filter. Someting I CAN test (and will report upon).



I would if I had two (non-clustered) systems communicating via DECNet (I have plans to create such a network but time is limited)

Willem