Another security awareness "device"

Thread View: vmsnet.sysmgt

1 messages

[T] Back to Threads [V] Tree View [G] Group Articles

1 total messages Started by rharwood Wed, 23 Dec 1992 16:12

#94

Author: rharwood
Date: Wed, 23 Dec 1992 16:12

25 lines
1803 bytes

I've received many requests for my SECAUDIT.COM procedure to monitor LOGFAILs
and BREAKINs detected by the AUDIT server, and I'm sure some folks have ftp'ed
the file, too.

Another security-monitoring "device" I use is a simple report generated every
evening of who has logged on the day before.  This way, I have some idea of the
"normal" usage patterns, and can more easily detect anything unusual.  I've not
made that procedure very elaborate, so it's included here (slightly modified). 
It reports the amount of CPU time and the "number of accounting records" for
each user-ID.  Note that some CPU times will be zero (for accounts which only
print files, for instance), and that login failures also get thrown into the
counts.

$ submit account.com /after="tomorrow+0:30"  ! Run again at midnight:30
$ set proc/priv=byp    ! Get read access to accountng.dat
$ account/since=yesterday/summary/report=(process,records)/out=account.lis
$ mail account.lis rharwood/subj="Daily CPU Usage"/pers="Batch Job ACCOUNT"

BTW, I use these files on all my client's machines, plus my own... for anyone
who thinks it's too much trouble to do for just *one* machine! <grin>
-----
Ray Harwood           |Data Basix           |Adjunct Faculty, East Campus,
Voice: (602)721-1988  |PO Box 18324         |   Pima Community College
FAX:   (602)721-7240  |Tucson, AZ 85731     |Instructor in Ada and Pascal
CompuServe: 76645,1370|AppleLink: DATA.BASIX|Internet: rharwood@east.pima.edu

Thread Navigation

This is a paginated view of messages in the thread with full content displayed inline.

Messages are displayed in chronological order, with the original post highlighted in green.

Use pagination controls to navigate through all messages in large threads.

Back to All Threads