Can i get this data more detail?

[Davor_7]

in UAF, we could find the "pwd change" time like below:

Pwdlifetime: 30 00:00 Pwdchange: 28-SEP-2005 08:00

How can i get it in more detail?
i.e. 28-SEP-2005 08:00:10.20
can i?

[Ian Miller.]

You could use SYS$GETUAI to read the user record and format the datetime yourself.

You could look at the corresponding audit record if you have auditing for authorization changes (which you should).

Why do you need to know the seconds ?

[Bojan Nemec · Accepted solution]

Davor,

I attach a short program in VAX MACRO to display the date with the SYS$GETUAI system service. Save the file and compile it with:
$ MACRO filename.ext
$ LINK filename.OBJ

When you run the program you will be prompted for the username and it will display the full date (or an error :). Run it from a privileged user or as the user you want to see the date.

Bojan

[Davor_7]

oh~ that's too difficult for me
is there any simple way to get detail time?
(i mean donot modify anything...)

[Ian Miller.]

The program given is straightforward to use but if you want to use existing utilities then
the audit log is probably your best bet then
See ANAL/AUDIT

something like

ANAL/AUDIT/EVENT_TYPE=AUTH/SELECT=USERNAME=username

[Davor_7]

thanks Miller
i have got the audit log but another question comes up.
is the time for audit log enough to be accurate? any delay in seconds?

i tested that for accounting log, almost no delay for the time stamp

[Robert_Boyd]

Another source for a tool to get this information is the freeware utility GETUAI available from

http://vms.process.com/fileserv-software.html

As it happens I am working on a little project myself today using GETUAI.

Once you download and @LINK you can do the following:

$ getuai = "$GETUAI"
$ getuai /pwdate=change_date

$ show symbol change_date


Cheers,
Robert

[Hein van den Heuvel]

This question was asked and answerred many times before, even in this very forum:

http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=890732

I found this with a google for: +vms +sysuaf +date +site:itrc.hp.com

hth,
Hein.

[Davor_7]

thanks all!

i have come to a simple way to get detail time of "pwdchange".

for your information, we open the "authorization"and"sysuaf" in the audit scope. then scan the record by full and you could get all the information, like below:(very detail!)
Security audit (SECURITY) on node1, system id: 11111
Auditable event: System UAF record modification
Event time: 2-SEP-2005 00:00:00.00
PID:
Process name: aaa
Username: aaa
Process owner: [aaa]
Terminal name: TNA3322
Image name:
Object class name: FILE
Object name:
User record: aaa
Password Date: New: 2-SEP-2005 00:00
Original: 2-JAN-2005 00:00
Password: New:
Original:
Posix UID: -2
Posix GID: