Operating System - OpenVMS
cancel
Showing results for 
Search instead for 
Did you mean: 

accountng.dat is corrupted

Rupert_1
Advisor

accountng.dat is corrupted

Hi,
When I issued command
analyze accountng.dat/audit/since=16-dec-2003/summary, I got %AUDSRV-W-BADRECORD, invalid data in record 6331,.....
Is there a way to recify the record ?
4 REPLIES
Martin P.J. Zinser
Honored Contributor

Re: accountng.dat is corrupted

Hello,

the first thing you want to do is redirect new events to a new log file. This can be done using

set audit/server=new_log

Once the old file is free

1.) Make another backup copy!
2.) Totally untested conjecture -
From looking at the audit log it seems it
contains one event per record.
So the following procedure might work

*anal/rms/fdl on the audit log ->security.fdl
*edit/tpu, delete line 6331
*convert/fdl=security.fdl edited_copy good_audit

Good luck,

Martin
Lokesh_2
Esteemed Contributor

Re: accountng.dat is corrupted

Hi ,

The security audit file is SECURITY.AUDIT$JOURNAL . So, use this file in place of accountng.dat. To see information of ACCOUNTNG.DAT , use ACCOUNTING utility.

$ACCOUNTING/SINCE=16-DEC-2003/SUMM ACCOUNTNG.DAT

Thanks & regards,
Lokesh
What would you do with your life if you knew you could not fail?
Terry Yeomans
Frequent Advisor

Re: accountng.dat is corrupted

To free of the file (and create a new version), do the following:
SET ACCOUNTING /DISABLE
SET ACCOUNTING /ENABLE
SET ACCOUNTING /NEW_FILE
Then have a play with your old file, which will be called SYSTEM_DISK:[SYS0.SYSMGR]ACCOUNTNG.DAT
Terry.

Re: accountng.dat is corrupted

Given the analyze/audit-command you are issuing, it looks like you would like to get auditing-information (instead of Accounting-data, which the input-file contains).

To find out which input-file to specify, use the '$ SHOW AUDIT'-command and look at the destination-file.

$ sho audit/all
Journal name: SECURITY
Journal owner: (system audit journal)
Destination: DISK1:[DIRECTORY]SECURITY_AUDIT.LOG

$ anal/audit DISK1:[DIRECTORY]SECURITY_AUDIT.log

31-DEC-2003 00:00:01.95 LOGIN NETWORK NODE1 UCX$SNMP 228005DE
31-DEC-2003 00:00:04.25 LOGIN NETWORK NODE1 UCX$SNMP 228005DF
31-DEC-2003 00:00:05.56 LOGIN NETWORK NODE1 UCX$SNMP 228005E0
31-DEC-2003 00:00:07.73 LOGIN NETWORK NODE1 UCX$SNMP 22800602
31-DEC-2003 00:00:09.14 LOGIN NETWORK NODE1 UCX$SNMP 22800603
31-DEC-2003 00:00:10.47 LOGIN NETWORK NODE1 UCX$SNMP 22800604