HP OpenVMS Systems

Parsing audit records?

» close window

The Question is:

 
Hi,
 
I am writing an application server for a client who wants to query the login
 history for a given VMS Username in a report on our PC client.
 
Browsing through the literature suggests that I read the audit journal file and
 use SYS$FORMAT_AUDIT to get a formatted string as the result. This means I
 have to parse the string to filter on username and date/time.
 
Is the right approach?
 
Can I get a structure with record types and binary date/time values etc.?
 
Do I read the audit journal file or is there a system service to do this for me?
 
Thanks for your time,
 
Shaun
 

The Answer is :

Rather than re-parsing the record you had just formatted,
the Wizard would suggest evaluating each audit journal record
first, according to the layout described in Appendix F of the
current System Management Utilities Reference Manual.  Write
just enough code to find the Username (and date/time) and
compare it. Then you can call SYS$FORMAT_AUDIT only for
those records which match your selection criteria.
 
Since you indicate this is being done for a client where
you might not have operational control, the Wizard would
suggest you consider checking for whether auditing of
Logins is still enabled.  Since you are reading the
audit journal anyway, an easy way to check this is
to keep track of whether there are _any_ records
for login events present in the file, and if not
display an informational message in place of your
report.

  

     

     
answer written or last revised on ( 9-MAY-2000 )
     
» close window