Monitoring Users login information of with in a network.

[Anjan Ganguly]

I have a set of Alpha VMS DS10 machines conected in LAN and I want to see an history of users logged on a perticular machine(out of 10 machines connected in LAN) for last 7 days.
Is there any way to do so?
My Open VMS Version is 7.2-1.

[Craig A]

Anjan

Have a look at ACCOUNTING

$ ACC/FULL/USER=

The Accounting file usually resides in SYS$MANAGER: so you will need to add that to the end of the above command, or specifcy the correct location for the Accounting file.

HTH

Craig

[Bhadresh]

Hi Anjan,

You can use /since qualifier along with command given by Craig to find last 7 days data.

$ ACC/SINCE= 20-JUL-2010/FULL/USER=

Regards,
Bhadresh

[Hoff]

>You can use /since qualifier along with command given by Craig to find last 7 days data...

The use of /SINCE="-7-" gets the last seven days of data can be appropriate, and often with less coding effort.

And getting back to the OP, I'd look to get auditing and accounting configured appropriately on the servers. See the SHOW ACCOUNTING and SHOW AUDIT commands, as a starting point, and then SET ACCOUNTING and SET AUDIT as appropriate for local requirements.

Also get the T4 tools going, but that's another topic.

Also recognize that active users don't and won't get audit records until they log out; you might not (or won't) get records for all of the users logged in. That's an oft-discussed restriction, and can lead to subtle problems with the results of the obvious commands.

While the boxes should be upgraded and ECO'd to something more current (V7.3-2 or maybe V8.3) and given the comparatively ancient software and hardware in use, that's not likely going to happen prior to server replacement.

[Craig A]

>Also recognize that active users don't and >won't get audit records until they log out

Hoff

Can I just check what you mean here. If a server has login=all/audit enabled, does this audit not get written at login time?

OP:

It might be useful to have something in SYLOGIN.COM to pop a REQUEST message out to the console or operator.log or both which you can then interrogate. It is, of course, going to depend on what you are trying to achieve in terms of tracking logins/usage.

HTH

Craig

[Hoff]

Sloppy wording on my part. Accounting gets the termination record when you log out or when you your process is deleted, and that record includes the login data, and you won't uniformly find data for a user's process until then. (Dig around for earlier discussions. This on-logout behavior has confounded many folks over the decades.)

There are other corner cases, such as the lack of process accounting records after system crashes. Which means spotting system boot records, and recognizing that you'll have probably "lost" some of the process accounting data upstream of that.

(This behavior particularly bothered the service bureaus in Ye Olden Daze. The service bureaus folks then tended to add extensions that generated an accounting record at login. It's a little surreal mentioning service bureaus with VMS, as that hasn't been a commonplace occurrence in some eons. But I digress.)

Auditing can be a better data source, as you can (if enabled) catch and log both the logins and the logouts.

I tend to end up processing the data records with a simple state machine here as it's easier to implement and to tweak, and I prefer to enable and use auditing as the data source.

One of my favorite (obscure, integrated) hammers when presented with a requirement for a state table is the tparse, err, lib$table_parse support, the finite-state table-driven parser, but that's another digression.

And another option for heterogeneous environments is to send the auditing data over to a server via (open-source add-on) syslog client, and doing the the data reduction via syslog tools. But again I digress.

This reply is a repost, as ITRC is being, well, ITRC again.

[Craig A]

Thanks, Hoff, for the response.

ITRC being ITRC? :-)

Craig

[Anjan Ganguly]

I have used the command $acc/since=28-jul-2010/full/user=*.
It says error searching for SYS$COMMON:[SYSMGR]ACCOUNTING.DAT;
How to rectify this?

[Volker Halle]

Anjan,

the default name of the system accounting file is SYS$MANAGER:ACCOUNTNG.DAT - check if that file exists.

You've typed the error messages refering to
SYS$COMMON:[SYSMGR]ACCOUNTING.DAT

The 'I' inside the file name shown is most likely a typing error on your part and if that assumption is true, the accounting file does not exist and accounting is turned OFF.

You can turn on accounting with $ SET ACCOUNTING/ENABLE command, check HELP SET ACC. Note that there will be a $ SET ACC/DISABLE command in one of your startup procedures, as accounting is normally turned ON by default.

Volker.

[Kelly Stewart_1]

Anjan,

Also be aware that the accounting file may not contain 7 days of data. A new, empty accounting file version can be created with the command SET ACCOUNTING/NEW_FILE. If this has been done recently, you must execute the ACC command on each version of the accounting file that was in use during the 7 days, or use a wildcarded accounting filename in the ACC command.

An example of the wildcarded filename is ACC SYS$MANAGER:ACCOUNTNG.DAT;* /FULL/PROCESS=INTERACTIVE/SINCE="-7-".

By the way, on my OpenVMS Alpha 7.3-2 system, "/user=*" does not match any users.

Kelly

[Anjan Ganguly]

Now I am able to enable Accounting and my Accountng.dat file is created.But how to read information from that file?Can u tell me some of the commands to read that?Also I want to create a new version of Accounting file after every five hours in order to avoid any disk space unavailability as the volume of the file is huge for one day.Can some body help me in this regard?

[Volker Halle]

Anjan,

to read the accounting file, use the $ ACC command, you'll get more usage information with $ HELP ACCOUNTING

To switch to a new accounting file, use $ SET ACC/NEW_FILE

If IMAGE accounting is turned on (check with $ SHOW ACC) and you don't need this information, consider to turn it OFF: $ SET ACC/DISABLE=IMAGE. It will write an accounting record for each image activation and can thus create huge accounting files.

Volker.