capture telnet location field in accountng?

[Dave Lennon]

Hi,
We notice when someone does a telnet from a VMS node to another VMS node using HP TCPIP the TT_ACCPORNAM shows up as:
Host: LOCALHOST Locn: _TNA6:/LENNON
with the Host being the source IP address and "Locn:" being the source terminal and username of that login.
We'd like to somehow capture and log that information, preferrably in the standard accounting process termination record.
I've seen tools such as LOG_PORT which saves LAT information by stuffing it into the DECnet fields of the running process which then get put into the accounting record.
I was wondering if anyone has tried stuffing this in a different (longer) field, such as the queue name and if that is even possible. Would something, such as this, normally not used in a interactive process termination record even get written to accounting file if it could be stuffed into a running process memory location?

Thanks,
Dave

[labadie_1]

You could build your tool after the netinfo.com procedure

http://groups.google.com/group/comp.os.vms/msg/d724acded9a18d2a

[Jon Pinkley · Accepted solution]

Dave,

As far as I know there is nowhere to stuff the queue name; the job controller gets it from the queue manager.

If all you want is a record of this info as of the login and logout time, you can get it from VMS auditing, as long as you are auditing login and logouts.

See attachment for more details.

Jon

[Hoff]

Y'all seem to be working way too hard here? Enable the stuff that interests you with a SET AUDIT command (something such as "set aud /audit /enable=( login=all, logout=all)" or some such) and have a look at the security auditing data. Then wander back over here if that's not what you are looking for.

[John Gillings]

Dave,

ACCOUNTNG is for gathering accounting & chargeback information on terminated processews, not for logging process logons.

Be aware that the accounting record is not written until the process terminates (which can potentially be a LONG time after the login). If the system crashes, or loses power, you won't get accounting records for processes that were current.

As Hoff suggested, auditing LOGINs will give you an audit record, with the information you want, at the time of the login.

Don't use a hammer, when the appropriate tool is a screwdriver.

[Dave Lennon]

Thanks everyone for the helpful info. I've seen the light and I was over-thinking it. Enabling auditing for login/logouts (but not alarms!) Nicely solves the problem and captures the tt_accpornam info. Special thanks to Jon for the detailed response attachment.