remotely monitor login alarm in OpenVMS

[Loh Chi Tsung]

Hi,

I'm not really an OpenVMS user... so any help would be really appreciated.

Recently, I have come across a security requirement from a customer which they want to have a centralized monitoring for any break in attempts. Currently they have 8 OpenVMS clusters.

Is there a way to direct redirect the security log to a remote server like a remote syslog functions in Unix/Linux ?

Thanks

[Wim Van den Wyngaert]

Not to my knowledge. We do every x minutes an anal/aud/fu, parse the output and scp a file with "the events" to the windows security server. For SOX.

If you write a program you can directly read the audit events and pass them in real time to whatever you like. We have a fortran program that passes it to an inhouse monitoring system (not for SOX).

Wim

[Phil.Howell · Accepted solution]

There is a syslog client, however you will have to construct some program or script on the vms side to send the log message.
Alternatives are ...
Configure the vms HPSIM agents to send an SNMP trap (easier said than done).
Use the nagios nrpe agent to send a trap, this also will involve some scripting at the vms end.
I'm not sure where I got the syslog client, I will check tomorrow.
Phil

[Loh Chi Tsung]

Hey Guys,

Thanks for the quick response.

I believe there are no off the shelf solution for this with out need of writing some scripts.

Thanks for the answer.

Cheers

[Loh Chi Tsung]

Use of script to trigger the logs to remote server.

[Phil.Howell]

the client is at
http://home.insightbb.com/~hemker/vms.html
there is also a syslog module in perl
(if the systems do perl)
Phil