VMS Help ANALYZE, /AUDIT, /SELECT, SUBTYPE *Conan The Librarian (sorry for the slow response - running on an old VAX) |
SUBTYPE=(subtype,...) Specifies that the criteria be limited to the value or values specified as a subtype. The following table lists events and their related subtypes. After SUBTYPE, enter the subtypes as they appear in the list; for example, SUBTYPE=ALARM_STATE. (In other words, do not enter a prefix.) Symbols for Event Types and Subtypes Meaning NSA$C_MSG_AUDIT Systemwide change to auditing ALARM_STATE Events enabled as alarms AUDIT_DISABLED Audit events disabled AUDIT_ENABLED Audit events enabled AUDIT_INITIATE Audit server startup AUDIT_LOG_FIRST First entry in audit log (backward link) AUDIT_LOG_FINAL Final entry in audit log (forward link) AUDIT_STATE Events enabled as audits AUDIT_TERMINATE Audit server shutdown NSA$C_MSG_BREAKIN Break-in attempt detected BATCH Batch process DETACHED Detached process DIALUP Dialup interactive process LOCAL Local interactive process NETWORK Network server task REMOTE Interactive process from another network node SUBPROCESS Subprocess NSA$C_MSG_CONNECTION Logical link connection or termination CNX_ABORT Connection aborted CNX_ACCEPT Connection accepted CNX_DECNET_CREATE DECnet logical link created CNX_DECNET_DELETE DECnet logical link disconnected CNX_DISCONNECT Connection disconnected CNX_INC_ABORT Incoming connection request aborted CNX_INC_ACCEPT Incoming connection request accepted CNX_INC_DISCONNECT Incoming connection disconnected CNX_INC_REJECT Incoming connection request rejected CNX_INC_REQUEST Incoming connection request CNX_IPC_CLOSE Interprocess communication association closed CNX_IPC_OPEN Interprocess communication association opened CNX_REJECT Connection rejected CNX_REQUEST Connection requested NSA$C_MSG_INSTALL Use of the Install utility (INSTALL) INSTALL_ADD Known image installed INSTALL_REMOVE Known image deleted NSA$C_MSG_LOGFAIL Login failure See subtypes for NSA$C_MSG_BREAKIN NSA$C_MSG_LOGIN Successful login See subtypes for NSA$C_MSG_BREAKIN NSA$C_MSG_LOGOUT Successful logout See subtypes for NSA$C_MSG_BREAKIN NSA$C_MSG_MOUNT Volume mount or dismount VOL_DISMOUNT Volume dismount VOL_MOUNT Volume mount NSA$C_MSG_NCP Modification to network configuration database NCP_COMMAND Network Control Program (NCP) command issued NSA$C_MSG_NETPROXY Modification to network proxy database NETPROXY_ADD Record added to network proxy authorization file NETPROXY_DELETE Record removed from network proxy authorization file NETPROXY_MODIFY Record modified in network proxy authorization file NSA$C_MSG_OBJ_ACCESS Object access attempted OBJ_ACCESS Access attempted to create, delete, or deaccess an object NSA$C_MSG_OBJ_CREATE Object creation attempted OBJ_CREATE Access attempted to create an object NSA$C_MSG_OBJ_DEACCESS Object deaccessed OBJ_DEACCESS Attempt to complete access to an object NSA$C_MSG_OBJ_DELETE Object deletion attempted OBJ_DELETE Object deletion attempted NSA$C_MSG_PROCESS Process controlled through a system service PRC_CANWAK Process wakeup canceled PRC_CREPRC Process created PRC_DELPRC Process deleted PRC_FORCEX Process exit forced PRC_GETJPI Process information gathered PRC_GRANTID Process identifier granted PRC_RESUME Process resumed PRC_REVOKID Process identifier revoked PRC_SCHDWK Process wakeup scheduled PRC_SETPRI Process priority altered PRC_SIGPRC Process exception issued PRC_SUSPND Process suspended PRC_TERM Process termination notification requested PRC_WAKE Process wakeup issued NSA$C_MSG_PRVAUD Use of privilege PRVAUD_FAILURE Unsuccessful use of privilege PRVAUD_SUCCESS Successful use of privilege NSA$C_MSG_RIGHTSDB Modification to the rights database RDB_ADD_ID Identifier added to rights database RDB_CREATE Rights database created RDB_GRANT_ID Identifier granted to user RDB_MOD_HOLDER List of identifier holders modified RDB_MOD_ID Identifier name or attributes modified RDB_REM_ID Identifier removed from rights database RDB_REVOKE_ID Identifier taken away from user NSA$C_MSG_SYSGEN Use of the System Generation utility (SYSGEN) SYSGEN_SET System parameter modified NSA$C_MSG_SYSTIME Modification to system time SYSTIM_SET System time set SYSTIM_CAL System time calibrated NSA$C_MSG_SYSUAF Modification to system user authorization file (SYSUAF) SYSUAF_ADD Record added to system user authorization file SYSUAF_COPY Record added to system user authorization file SYSUAF_DELETE Record deleted from system user authorization file SYSUAF_MODIFY Record modified in system user authorization file SYSUAF_RENAME Record renamed in system user authorization file
|