OpenVMS Notes: System Manager Tips

• move to the system manager directory
• enable opcom messages on this terminal (they still go to the log file)
• close the current operator log then open a new one
• disable opcom messages on this terminal
• purge extra copies of this file from this directory
• Note: many unattended VMS systems do this once a week from batch (optionally employing the  optional "/keep=2" option if security is a concern)

• move to the system manager directory
• close the current audit log then open a new one
• purge extra copies of this file from this directory
• Note: don't do this if someone at your company needs these files for security purposes

• move to the system manager directory
• close the current accounting file then open a new one
• purge extra copies of this file from this directory
• Note: don't do this if someone at your company needs these files to bill other clients for resources they used on your system

• see the disk names
• move to the root directory of disk $1$dia0: (use ds0: if shadowed)
• locate all files >= 99000 blocks (or whatever)
• <<< research your findings >>>

• <<< consider purging the disk of some logs >>>
• purge the disk of all some files (keeping the last 5 versions)
• Note: don't do this if you are having other problems which the log files could help solve

• <<< consider purging the disk of all logs >>>
• purge the disk of all log files
• Note: don't do this if you are having other problems which the log files could help solve

• <<< consider purging the disk of all files >>>
• purge the disk of all files
• Emergency Use Only (if you need to recover disk space)
• This is a last-resort command

• <<< optional command for TCPware >>>
• start the TCPware network control utility
• close the current log file then open a new one
• exit the TCPware network control utility
• purge TCPware log files

• Digital File Utility (from the freeware CD)
• see the disk names
• move to the root directory of disk $1$dia0: (use ds0: if shadowed)
• fire up DFU
• verify this disk (read only)
• verify this disk (write; only do this when system is idle)

$set audit/server=new
$set audit/class=file/audit/enable=access=(SUCCESS:DELETE) 
[...wait a short period of time for users to do their thing...]
$set audit/server=flush
$anal/audit/full/out=TEMP.TMP SYS$MANAGER:SECURITY.AUDIT$JOURNAL
[...if you no longer need this audit...]
$set audit/class=file/audit/disable=access=(SUCCESS:DELETE) 

• close the current audit log then open a new one
• enable the auditing of successful file deleting
• wait a short period of time
• push buffered audits into the file
• inspect the audit file
• when finished
• remove the audit

$set def someplace
$set def [-]
$dir *.dir/width=file=50
$set security						   -
 /acl=(ALARM=SECURITY,ACCESS=DELETE+WRITE+SUCCESS+FAILURE) - 
 neil.dir
$reply/enable=security
[... when done ...]
$set security/acl/delete neil.dir

• navigate to the directory in question
• go up on level
• get a directory of the directories
• attach an ACL to the directory in question
• copy security alerts to your terminal
• remove the acl from the file (er, directory)

• disable all opcom messages here
• enable security messages here
• request notification...
  ...of all accesses
  ...to this file
• view the attached ACLs to this file
• repeat
• [wait for a while]
• remove the notification

• close the current audit log then open a new one
• enable auditing of clock changes
• wait for a while
• push buffered audits into the file
• inspect the audit file

• navigate to the system manager's home directory
• see what events are currently audited
• enable auditing of all login failures (should be enabled)
• wait for a while
• push buffered audits into the audit file
• browse login failure in the audit file
• display detailed failure messages