Audit password changes

[Donald Robichaud]

Is it possible with the $ANALIZE/AUDIT/EVENT_TYPE=(SYSUAF)command to generate a report that just shows password changes to the SYSUAF file?

[Joseph Huber_1]

Yes,
if the AUTHORIZATION class is enabled:
$ set audit/audit/enable=authorization

[Joseph Huber_1]

Ah sorry, was typing too fast:
You want ONLY password changes, not other sysuaf changes.
Sorry, no at least I don't have an answer for that.

[Dale A. Marcy · Accepted solution]

Try the following command on your audit file:

$ analyze/audit/select=field_name=("Password Date")

[Donald Robichaud]

Thanks Dale. That's exactly what I was looking for.

[Ian Miller.]

Donald, see
http://forums1.itrc.hp.com/service/forums/helptips.do?#33
for assigning points and
http://forums1.itrc.hp.com/service/forums/helptips.do?#16
for closing threads.

[Jeroen Hartgers_3]

If audit is not an option it's also possible to create a dcl procedure because pwd change date is listed in de sysuaf.

[Jan van den Ende]

Donald,

the idea behind Ian´s remark really is that you do not leave ANY unassined answers...
Fully at your discretion, even assigning 0 (zero) points is fully OKay, but you ARE requested to invest at least THAT effort to anybody that took the time to answer you.

Proost.

Have one on me.

j