Finding all IP numbers of Telnet users

[Chris Barratt]

I am wanting to find a list of all the ip numbers of sessions that have used Telnet to our cluster in the last few months.
Ideally I would get this out of accounting, but there does not seem to be a useful option.

Something like account/summary=remote_id would seem to be useful, but does not currently exist (I am on 7.3-2).

The path I will pursue, after a quick search of forums, newsgroups and freeware will be to write a program to read the accounting file.

If anyone has any better ideas, I would love to hear them....

Cheers,
Chris

[labadie_1]

It might help to see what
ucx sh service telnet/ful
says, particularly the
log opts:
You should have that info in the operator.log

Account/full should show the ip address, requiring some stuff

ACCOUNT/FULL will show the IP address in hex as part of the remote id string

Terminal name: TNA5:
Remote node addr: 22493
Remote node name: SHL-11
Remote ID: TELNET_8612476E


For example in this fragment the ip address is 134.18.71.110
86x=134, 12x=18, 47x=71, 6Ex=110

[Chris Barratt]

Oops, sorry labadie...I was a bit too premature to allocate points on that last one.

Using your operator.log idea, I did the following,

$ search sys$manager:operator.log;* "Telnet login.com/out=z.lis
$ sort z.lis client_ws.txt/key=(pos:25,size:15)/nodup

and wallah, I had a file good enough for what was wanted (ie. sometimes it had IP numbers, sometimes it had machine DNS name).

Thanks,
Chris

[Karl Rohwedder]

Chris,

you may do a ACOCUNT/FU and sear for "Remote ID" or TELNET_.
Or you may enable auditing and do a ANALYZE/AUDIT, but I fear you have to search the output file.

regards Kalle

[labadie_1 · Accepted solution]

No problem

:-)

[Chris Barratt]

done and dusted