HP OpenVMS Systems

ask the wizard
Content starts here

Security Audits, Alarms, Logfails, and OPCOM?

» close window

The Question is:

 
We just upgraded from VMS 5.5-2h4 to 6.1 but now I'm
getting tons of OPCOM messages for problems which
weren't reported before. For example, if a user hits
^Z or lets the connection time out at the Username
prompt I receive:
%%%%%%%%%%%  OPCOM  14-JAN-1999 16:34:09.79  %%%%%%%%%%%
[...]
Username:                 <login>
[...]
Image name:               $1$DIA0:[SYS0.SYSCOMMON.][SYSEXE]LOGINOUT.EXE
Status:                   %LOGIN-F-CMDINPUT, error reading command input
 
I'm also getting a lot of:
 
%%%%%%%%%%%  OPCOM  14-JAN-1999 16:40:28.22  %%%%%%%%%%%
[...]
Username:                 <login>
Terminal name:            NTY663:, _NTY663:, [10.28.100.239]
Remote nodename:          TELNET
Remote username:          0A1C64EF:0C23
Status:                   %LOGIN-F-NOSUCHUSER, no such user
 
 
I don't want to turn off all login failure audits/alarms but
I would like it to only report real failures.
 
What do I need to do?
 
Thanks.

The Answer is :

 
  If you can describe how to differentiate "real failures"...
 
  If you wish to not receive particular groups of alarms, disable them via
  SET AUDIT commands -- realize that alarms can be routed to OPCOM and
  audits are routed to the security audit database -- paying particular
  attention to the breakin and logfailure classes.   Use SHOW AUDIT to
  see the current settings.
 
  Please do not abbreviate messages when posting questions -- part of the
  message that was expurgated here was the specific type of alarm.
 


  

     
     
answer written or last revised on ( 18-JAN-1999 )

     
» close window