HP OpenVMS Systems

Accounting and Auditing User Activity?

» close window

The Question is:

 
Please inform me which log (such as history log) should I use to generate
the system activities of any user based on their User ID (for example, I
would like to review the system activities of SYSTEM user ID).
 
Based on the VMS manual, there are 4 system log files:
 System Dump file
 Operator Log file
 Error Log file
 Accounting log file
 
Based on their definitions, these files keep track their own set of system
activities.
 
Thanks in advance for your help.  I would highly appreciate it if you could
send your reply the soonest.
 
 

The Answer is :

 
  The usual sources for tracking user activity include the accounting data
  file and the security auditing journal.  For information on the former,
  please see the ACCOUNTING utility.  For information on the latter, please
  see the SET and SHOW AUDIT commands, and the ANALYZE/AUDIT utility.
 
  Accounting tracks print, batch, and network jobs, user login and logout,
  and a variety of other activities of interest for user accounting.
 
  The particular security-relevent activities tracked by auditing are
  selectable by the site security officer, and can include a large number
  of system activities.
 
  Privileged users can override or disable security auditing and system
  accounting.  Privileged users are and must be trusted.  If you cannot
  trust any particular user, consider setting all privileged usernames
  to require a secondary password, and issue each of the two passwords
  to a different (trusted) user -- this forces both users to be present
  whenever the privileged username is used.
 
  For further information, please see the accounting and auditing utility
  documentation, as well as the system management and security manuals in
  the OpenVMS documentation.

  

     

     
answer written or last revised on ( 15-FEB-1999 )
     
» close window