🚀 go-pugleaf

In article <1992Dec18.145352.16583@vax5.cit.cornell.edu>, yqdx@vax5.cit.cornell.edu writes:
>   Are there techniques for
> logging the origin of attempted logins, and/or all logins in general?

Yes, and it's already being done for you, unless someone has disabled it. 

Try the ACCOUNTING command.  HELP ACCOUNTING should give you an idea of the
possibilities.  ACCOUNTING/TYPE=(LOGFAIL,PROCESS) is probably a good place to
start.  Add /FULL to get more information.  Add /SINCE=time and /BEFORE=time
to bracket a particular time period.  Add /USER=username to see entries for
just one user.  (Note that this will suppress login failure messages where no
username was recorded.)

(One thing which is not recorded, unfortunately, is the terminal server and 
port name for logins (and attempted logins) via LAT ports.)

While we're on the subject, you should do 

	$ set accounting/new

periodically, say once a day or once a week or so.  This closes out the current
accounting file (SYS$SPECIFIC:[SYSMGR]:ACCOUNTNG.DAT - note that it is not
...:ACCOUNTING.DAT) and starts a new one.  Unless you do this periodically 
you will have one giant file which will take forever to search through (unless
you have a very quiet system). 

It is almost always a good idea to back these files up to special archive tapes
which are explicitly kept forever (rather than relying on the regular system
backups) and then delete the ones that are too old to be of interest most of
the time. 

There are several manuals in the System Management portion of the VMS Extended
Documentation Set which you should read.  _Guide to VMS System Security_ and
the _VMS Accounting Utility_ manual come to mind.  Check the _System Management
Master Index_ for other references to the accounting log file. 

	--- Jamie Hanrahan, Kernel Mode Consulting, San Diego CA
drivers, internals, networks, applications, and training for VMS and Windows-NT
uucp 'g' protocol guru and release coordinator, VMSnet (DECUS uucp) W.G., and 
Chair, Programming and Internals Working Group, U.S. DECUS VMS Systems SIG 
Internet:  jeh@cmkrnl.com, hanrahan@eisner.decus.org, or jeh@crash.cts.com
Uucp:  ...{crash,eisner,uunet}!cmkrnl!jeh