AUDIT SERVER - Revision history

Thilo.lauer at 09:56, 23 August 2023

2023-08-23T09:56:01Z

← Older revision		Revision as of 09:56, 23 August 2023
Line 38:		Line 38:

	To start a new audit journal log file, do		To start a new audit journal log file, do
	SET AUDIT/SERVER=NEW		$ SET AUDIT/SERVER=NEW

	This will close the current file and open a new one.		This will close the current file and open a new one.

	[[Category:Security]]		[[Category:Security]]

Thilo.lauer at 09:55, 23 August 2023

2023-08-23T09:55:39Z

← Older revision		Revision as of 09:55, 23 August 2023
Line 38:		Line 38:

	To start a new audit journal log file, do		To start a new audit journal log file, do
	~~set audit~~/~~server~~=~~new~~		SET AUDIT/SERVER=NEW

	This will close the current file and open a new one.		This will close the current file and open a new one.

	[[Category:Security]]		[[Category:Security]]

Thilo.lauer at 09:55, 23 August 2023

2023-08-23T09:55:06Z

← Older revision		Revision as of 09:55, 23 August 2023
Line 17:		Line 17:

	$ @SYS$SYSTEM:STARTUP OPCOM		$ @SYS$SYSTEM:STARTUP OPCOM

	$ @SYS$SYSTEM:STARTUP AUDIT_SERVER		$ @SYS$SYSTEM:STARTUP AUDIT_SERVER

Thilo.lauer at 09:54, 23 August 2023

2023-08-23T09:54:51Z

← Older revision		Revision as of 09:54, 23 August 2023
Line 16:		Line 16:
	To restart security auditing and [[OPCOM]] on the system, enter:		To restart security auditing and [[OPCOM]] on the system, enter:

	$ @SYS$SYSTEM:STARTUP OPCOM		$ @SYS$SYSTEM:STARTUP OPCOM

	$ @SYS$SYSTEM:STARTUP AUDIT_SERVER		$ @SYS$SYSTEM:STARTUP AUDIT_SERVER

	To avoid starting the audit server during startup, remove it from the startup database (requires [[OPER]] and [[BYPASS]]:		To avoid starting the audit server during startup, remove it from the startup database (requires [[OPER]] and [[BYPASS]]:

Thilo.lauer at 09:54, 23 August 2023

2023-08-23T09:54:20Z

← Older revision		Revision as of 09:54, 23 August 2023
Line 17:		Line 17:

	$ @SYS$SYSTEM:STARTUP OPCOM		$ @SYS$SYSTEM:STARTUP OPCOM

	$ @SYS$SYSTEM:STARTUP AUDIT_SERVER		$ @SYS$SYSTEM:STARTUP AUDIT_SERVER

Line 34:		Line 35:
	SYSMAN> STARTUP SET DATABASE STARTUP$STARTUP_VMS		SYSMAN> STARTUP SET DATABASE STARTUP$STARTUP_VMS
	SYSMAN> STARTUP ENABLE FILE VMS$CONFIG-050_OPCOM.COM/NODE=*		SYSMAN> STARTUP ENABLE FILE VMS$CONFIG-050_OPCOM.COM/NODE=*
	SYSMAN> STARTUP ENABLE FILE VMS$CONFIG-050_AUDIT_SERVER.COM/NODE=*		SYSMAN> STARTUP ENABLE FILE VMS$CONFIG-050_AUDIT_SERVER.COM /NODE=*
	SYSMAN> EXIT		SYSMAN> EXIT

Thilo.lauer at 09:53, 23 August 2023

2023-08-23T09:53:22Z

← Older revision		Revision as of 09:53, 23 August 2023
Line 34:		Line 34:
	SYSMAN> STARTUP SET DATABASE STARTUP$STARTUP_VMS		SYSMAN> STARTUP SET DATABASE STARTUP$STARTUP_VMS
	SYSMAN> STARTUP ENABLE FILE VMS$CONFIG-050_OPCOM.COM/NODE=*		SYSMAN> STARTUP ENABLE FILE VMS$CONFIG-050_OPCOM.COM/NODE=*
	SYSMAN> STARTUP ENABLE FILE VMS$CONFIG-050_AUDIT_SERVER.COM -		SYSMAN> STARTUP ENABLE FILE VMS$CONFIG-050_AUDIT_SERVER.COM/NODE=*
	~~_SYSMAN>~~ /NODE=*
	SYSMAN> EXIT		SYSMAN> EXIT

Jane.doe at 14:59, 25 July 2023

2023-07-25T14:59:06Z

← Older revision		Revision as of 14:59, 25 July 2023
Line 37:		Line 37:
	_SYSMAN> /NODE=*		_SYSMAN> /NODE=*
	SYSMAN> EXIT		SYSMAN> EXIT

			To start a new audit journal log file, do
			set audit/server=new

			This will close the current file and open a new one.

	[[Category:Security]]		[[Category:Security]]

Jane.doe: Created page with "'''AUDIT_SERVER''' is a detached system process created during system startup that performs security auditing on an OpenVMS system. The following tasks a..."

2019-12-12T11:03:29Z

Created page with "'''AUDIT_SERVER''' is a detached system process created during system startup that performs security auditing on an OpenVMS system. The following tasks a..."

New page

'''AUDIT_SERVER''' is a detached system process created during system startup that performs [[Security Auditing|security auditing]] on an OpenVMS system. The following tasks are performed by the audit server:
* Create a clusterwide security audit log file (SECURITY.AUDIT$JOURNAL) in SYS$COMMON:[SYS$MGR]
* Control the logging of security events to the log file and the delivery of alarms to any operator terminals enabled to receive security class messages
* Enable auditing of a site-defined set of security events
* Monitor disk and memory resources
* Maintain a database of security-auditing characteristics

The audit server sends informational and error messages to the [[OPCOM|operator communication manager (OPCOM)]]. [[OPCOM]] broadcasts these messages to operator terminals and writes the messages to the [[Operator Log File|operator log file]].

Security auditing settings are stored in the [[Security Auditing#Audit Server Database|audit server database]] and can be modified with [[SET AUDIT]] and viewed with [[SHOW AUDIT]]. Depending on these settings, audit messages can be written to the [[Security Auditing#Security Audit Log File|security audit log file]] or sent to a security-enabled operator terminal (i.e. security alarms).

The audit server process is started automatically; cluster object support requires the audit server. To shut down security auditing on the system, use the following commands on each node in the cluster:
$ SET AUDIT/ALARM/AUDIT/DISABLE=ALL/CLASS=*
$ SET AUDIT/SERVER=EXIT

To restart security auditing and [[OPCOM]] on the system, enter:

$ @SYS$SYSTEM:STARTUP OPCOM
$ @SYS$SYSTEM:STARTUP AUDIT_SERVER

To avoid starting the audit server during startup, remove it from the startup database (requires [[OPER]] and [[BYPASS]]:

$ SET PROCESS/PRIVILEGES=(OPER,BYPASS)
$ MCR SYSMAN
SYSMAN> STARTUP SET DATABASE STARTUP$STARTUP_VMS
SYSMAN> STARTUP DISABLE FILE VMS$CONFIG-050_OPCOM.COM/NODE=*
SYSMAN> STARTUP DISABLE FILE VMS$CONFIG-050_AUDIT_SERVER.COM /NODE=*
SYSMAN> EXIT

To add the audit server to the startup sequence, add it to the startup database (requires [[OPER]] and [[BYPASS]]:

$ SET PROCESS/PRIVILEGES=(OPER,BYPASS)
$ MCR SYSMAN
SYSMAN> STARTUP SET DATABASE STARTUP$STARTUP_VMS
SYSMAN> STARTUP ENABLE FILE VMS$CONFIG-050_OPCOM.COM/NODE=*
SYSMAN> STARTUP ENABLE FILE VMS$CONFIG-050_AUDIT_SERVER.COM -
_SYSMAN> /NODE=*
SYSMAN> EXIT

[[Category:Security]]