As others mentioned, capturing the command via a UDC would seem to be the
only way to capture the command. Doing so isn't as hard as some think though
if you use the "ANYPARM" option in the UDC. Here's an example UDC we use on
our systems to capture many operator-type commands:
(though it doesn't show up in the email, we also have inverse-video
escape-sequences after the "tellop " in each case, helping the commands
stand out just a little more on a busy system console. Set the UDC
system-wide. Add an ALTPROC command using the same format as the others.)
altspoolfile dfid
ANYPARM other_parms
option nohelp
tellop altspoolfile !dfid;!other_parms
altspoolfile !dfid;!other_parms
***
deletespoolfile dfid
option nohelp
tellop deletespoolfile !dfid
deletespoolfile !dfid
***
altjob jnum
ANYPARM other_parms
option nohelp
tellop altjob !jnum;!other_parms
altjob !jnum;!other_parms
***
abortjob
ANYPARM all_parms
option nohelp
tellop abortjob !all_parms
abortjob !all_parms
***
abortio ldev
option nohelp
tellop abortio !ldev
abortio !ldev
***
stopspool ldev
option nohelp
tellop stopspool !ldev
stopspool !ldev
***
startspool ldev
option nohelp
tellop startspool !ldev
startspool !ldev
***
spoolf
ANYPARM all_parms
option nohelp
setvar _parms ups("!all_parms")
setvar _parms repl("!_parms","'","")
if pos('DELETE','!_parms')>0 then
tellop SPOOLF !all_parms
endif
spoolf !all_parms
***
suspendspool
ANYPARM all_parms
option nohelp
tellop suspendspool !all_parms
suspendspool !all_parms
***
breakjob jnum
option nohelp
tellop breakjob !jnum
breakjob !jnum
***
resumejob jnum
option nohelp
tellop resumejob !jnum
resumejob !jnum
***
outfence
ANYPARM all_parms
option nohelp
tellop outfence !all_parms
outfence !all_parms
***
HTH,
Chris Bartram
-----Original Message-----
From: JohnMcDowell [mailto:[log in to unmask]]
Sent: Tuesday, July 22, 2003 12:16 PM
To: [log in to unmask]
Subject: [HP3000-L] LOGGING
I have someone executing the ALTPROC command inappropriately. I checked the
logs, and it doesn't record it. Is there an event that needs to be on to
record this command? Listed below are what I have turned on now. I know the
best solution is to not allow capability, and I am working on this now, but
until then I would like to find who is doing it. Thanks
configurable item max min current
----------------- ------- ------- -------
# of user logging processes 128 2 64
# users per logging process 1140 1 128
system log events event # status
----------------- ------- ------
System Logging 100 ON
System Up 101 ON
Job Initiation 102 ON
Job Termination 103 ON
Process Termination 104 ON
NM File Close 105 OFF
System Shutdown 106 ON
Power Failure 107 ON
I/O Error 111 ON
Physical Mount/Dismount 112 OFF
Logical Mount/Dismount 113 OFF
Tape Label 114 OFF
Console Log 115 ON
Program File Event 116 ON
Native Mode Spooling 120 OFF
File Quarantine Event 121 OFF
Chdir 127 OFF
Process Adoption 128 OFF
File Owner Change 129 ON
Architected InterFace 130 OFF
Additional Processor Launch 131 OFF
Password Change 134 ON
System Logging Configuration 135 OFF
Restore 136 ON
Printer Access Failure 137 OFF
ACD Change 138 ON
Stream Initiation 139 ON
User Logging 140 ON
Process Creation 141 OFF
Security Configuration Change 142 ON
Chgroup 143 OFF
File Open 144 OFF
CI Command Logging 145 ON
Maintenance Request 146 ON
UPS Monitor Event Logging 148 OFF
Diagnostic Information 150 ON
High Priority Machine Check 151 ON
Low Priority Machine Check 152 ON
Directory Open/Close Logging 155 ON
CM File Close 160 OFF
log>
John McDowell, Operations Manager
Quadax, Inc
www.quadax.com
[log in to unmask]
440-788-2130
fax: 440-788-2199
* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *
* To join/leave the list, search archives, change list settings, *
* etc., please visit http://raven.utc.edu/archives/hp3000-l.html *
|
