Neale Ferguson on Wed, 24 Jun 2009 17:32:14 -0700 wrote
* Are you really after all the security violations? If so, an
* accounting record is cut for every violation. The log messages
* (by default) will only print after 3 or more attempts.
* Similarly, if you are after all
* logon/logoff/disconnect/reconnect records an accounting record
* is cut for these also. On your system the user ACCOUNT is
* usually set up to receive these messages. You can find the
* layout of these records in the CP docs. And it is relatively
* trivial to process these records in a REXX or PIPE to produce
* the reports or log files that you are after.
I suppose you're right, Neale. I had hoped for a quick and dirty fix for
the current way we are doing it. We do process the CPU, network type
accounting records currently. I guess I'll have to adopt your approach,
seeing how there doesn't appear to be an easy solution to processing the
logs. Thanks for your help.
Regards,
Fred
Fred Schmidt
Senior Systems Programmer
Data Centre Services
Department of Business and Employment
Northern Territory Government of Australia
GPO Box 2391, Darwin NT 0801
* (08) 8999 6891 * (08) 8999 7493
* [email protected] ! DBE <http://www.nt.gov.au/dbe/>
