HP OpenVMS Systems

Content starts here

HP Advanced Server for OpenVMS
Server Administrator's Guide

Previous Contents Index

2.2.2 Managing the Audit Policy

You specify the audit policy using the SET AUDIT POLICY command. When auditing is enabled, the server records selected security-related activities in the Security event log. The server can record systemwide events, such as a user logging on, and file-specific events, such as a user attempting to access a specific file. You display the audit policy using the SHOW AUDIT POLICY command.

The audit policy affects Security event logging for all servers in the domain, because they share the same audit policy. You can specify whether to log failed events and successful events. See Table 2-3 for a list of the events that you can audit. Note that to audit events pertaining to files or directories (ACCESS events), you must also set auditing on the files or directories. For more information, see Section, Setting and Displaying Security Event Auditing for Files and Directories.

Table 2-3 Events You Can Audit
Audit Event Name Events Audited
ACCESS - A user accessing a directory or file that is set for auditing (SET FILE/AUDIT=)
- A user sending a print job to a printer that is set for auditing
ACCOUNT_MANAGEMENT - Creating, changing, or deleting a user account or group
- Renaming, disabling, or enabling a user account
- Setting or changing a password
LOGONOFF - A user logging on or logging off
- A user making a network connection
POLICY_CHANGE - Changing the audit policy
- Changing a trust relationship
- Changing user rights policies
PROCESS - Program activation
- Handling duplication
- Indirect object access
- Process exit
SYSTEM - A user starting or restarting a server
- A system security event
- An event that affects the security log
USER_RIGHTS - A user exercised a user right such as accessing a file, except for logon/logoff rights Example: Displaying the Audit Policy for a Domain

The following example shows how to display the audit policy for a domain:


Audit Policy for domain "LANDOFOZ":

Auditing is currently Disabled.

Audit Event states:

Audit Event         Success   Failure
------------------- --------  --------
ACCESS              Disabled  Disabled
ACCOUNT_MANAGEMENT  Disabled  Disabled
LOGONOFF            Disabled  Disabled
POLICY_CHANGE       Disabled  Disabled
PROCESS             Disabled  Disabled
SYSTEM              Disabled  Disabled
USER_RIGHTS         Disabled  Disabled

LANDOFOZ\\TINMAN> Example: Enabling Auditing and Setting the Audit Policy for a Domain

The following example shows how to enable auditing and set the audit policy for a domain, using the SET AUDIT POLICY/AUDIT command. In this example, the /SUCCESS=LOGONOFF qualifier enables auditing of successful logon and logoff operations.

%PWRK-S-AUDPOLSET, audit policy set for domain "LANDOFOZ"

Audit Policy for domain "LANDOFOZ":

Auditing is currently Enabled.

Audit Event states:

Audit Event         Success   Failure
------------------  --------  --------
ACCESS              Disabled  Disabled
ACCOUNT_MANAGEMENT  Disabled  Disabled
LOGONOFF            Enabled   Disabled
POLICY_CHANGE       Disabled  Disabled
PROCESS             Disabled  Disabled
SYSTEM              Disabled  Disabled
USER_RIGHTS         Disabled  Disabled


To enable auditing of all events, use the following command:


2.3 Managing a Server

When you manage a server, you can display server information, send messages to users, and start and stop services.

2.3.1 Displaying Server Information

You can display information about the server including connections, user sessions, shared resources, and the software version number. Displaying Connections

As you manage your server, you may need to know which connections are active. A connection is a virtual link between a workstation or a server process and a shared resource on a server.

To display existing connections, use the SHOW CONNECTIONS command. The SHOW CONNECTIONS command displays information about active connections to the server, including connections from the Advanced Server. The information about each connection includes:

  • Connected user's name
  • User's computer name (including connections from the Advanced Server)
  • Name of the shared resource connected to
  • Number of opens to each share
  • Total connect time to the share (in days, hours, minutes)

The following example displays information about all the connections to the server currently being administered (TINMAN).


  Connections on server "TINMAN":

  User name             Computer name    Share name  Opens  Time
  --------------------  ---------------  -----------------  --------
  ADMINISTRATOR         TINMAN_176       IPC$           3   0 11:30
  SCARECROW             TINMAN_149       ADMIN$         0   0 00:00
  SCARECROW             TINMAN_149       IPC$           0   0 00:00
  SCARECROW             TINMAN_149       IPC$           1   0 00:00
  SCARECROW             TINMAN_149       RAINBOW        0   0 06:14

    Total of 5 connections Displaying User Sessions

As you manage your server, you may need to know which sessions are active. A session is a link between a workstation and a server. Multiple share connections can be established over a single session.

To display user sessions, use the SHOW SESSIONS command. You can include the /SERVER qualifier to display sessions on a specific server. The display includes:

  • Name of the user that established the session
  • Name of the computer that established the session
  • Number of resources opened on the server by user
  • Elapsed time since the session was established
  • Elapsed time since the user last initiated an action
  • Whether a session is using Guest access

For example:


User sessions on server "WOODMAN":

Connected Users     Computer      Opens   Time       Idle       Guest
------------------  ---------     -----   -------    -------    -----
ADMINISTRATOR       TINMAN            1   1 22:54    0 00:00    No
SCARECROW           DOROTHY           3   0 03:48    0 00:03    No

  Total of 2 connected users

LANDOFOZ\\TINMAN> Displaying Shared Resources

The Advanced Server allows you to display information about shared resources. You can display information about the share permissions and the OpenVMS protections on them, as well as the maximum number of connections to the share allowed at one time. You can specify the display of only the active shares (those currently connected to) or by the type of share (printers or directories).

To see shared resources from the current server, use the SHOW SHARES command. This command displays:

  • Name of the share
  • Share type (Directory or Print)
  • Share description

Specify the share name to display information about only one share. Use the /FULL qualifier to display detailed information about each share.

For example, the following command displays the shares on the server currently being administered (TINMAN):


Shared resources on Server "TINMAN":

Name              Type          Description
---------       ---------       ----------------------------------
NETLOGON        Directory       Logon Scripts Directory
RAINBOW         Directory       Local Oz Share
PWLIC           Directory       PATHWORKS Client License Sftwr
PWLICENSE       Directory       PATHWORKS Client License Sftwr
PWUTIL          Directory       Adv. Srv. Client-based Utilities
USERS           Directory       Users Directory

   Total of 6 shares


To display hidden shares (shares whose name ends in a dollar sign ($), such as administrative resources and local device shares (such as C$)), you must include the /HIDDEN qualifier or specify the share name. For example, the following command displays the local device share C$:


Shared resources on Server "TINMAN":

Name          Type       Description
------------  ---------  ----------------------------------------
C$            Directory  PATHWORKS share

  Total of 1 share Displaying the Advanced Server Version Number

You can verify the version number of Advanced Server software. To display the version number of server software on your system, use the SHOW VERSION command. For example:


Advanced Server V7.3B for OpenVMS


This command is valid for PATHWORKS for OpenVMS (Advanced Server) and Advanced Server for OpenVMS servers only.

2.3.2 Stopping the Advanced Server

You can stop the Advanced Server at any time for any reason, which can include the following:

  • When you want to change server configuration parameters
  • As part of an orderly system shutdown

To stop the Advanced Server, enter the following command:

Shutting down the currently running server(s)...

For a cluster server, enter:


To stop the Advanced Server as part of an orderly system shutdown, add the shutdown command to the site-specific system shutdown procedure. In addition, prior to shutting down the server, announce the planned shutdown to connected users by using the ADMINISTER SEND/USERS command, as described in Section 2.3.3, Sending Messages to Users.

2.3.3 Sending Messages to Users

You should send messages to users before you change the operating characteristics of a server. For example, you might send a message before disconnecting users or if you need to stop sharing a resource on a computer. For a message to be sent and received, the Alerter service must be running on the computer sending the message, and the Messenger service must be running on the computer receiving the message.


The Messenger service is not supported on the Advanced Server. Therefore, OpenVMS users on Advanced Servers will not receive messages sent this way. Sending a Message to the User of a Specific Computer

To send a message to the user of a specific computer, follow these steps:

  1. Identify the computer to which you will send your message.
  2. Enter the ADMINISTER SEND command, including the computer name and the message. Enclose the message in quotation marks.

For example, the following command sends the message "Shutdown at 1 pm today!!!" to the computer called WORTHY.

LANDOFOZ\\TINMAN> SEND WORTHY "Shutdown at 1pm today!!!"

The message is displayed in a Messenger Service pop-up window on computer WORTHY in the following form:

       Message from TINMAN to WORTHY on 8/31/00 11:20 AM
       "Shutdown at 1pm today!!!"

With the /SERVER=servername qualifier, you can send a message from another specified server in your domain to a specific group of users in your domain. With the /USER qualifier, you can send a message to all or specific users on a server. Sending a Message to Users on a Specific Server

To send a message to users connected to a specific server, use the /SERVER qualifier. For example, the following command sends the message "Shutdown at 1pm today!!!" to all users connected to server WOODMAN.



This command may take a few minutes to complete.

2.3.4 Managing Services

To manage Advanced Server services, you need to know how to start and stop services and how to configure service startup. Services are set up during server installation and configuration.

You can start and stop some of the services available on the computer and determine whether a service will start up automatically when the system starts. You must be logged on to a user account that has membership in the Administrators group or the Server Operators group to perform these operations. Table 2-4, Network Services on the Advanced Server, shows the default services provided with Advanced Server.

Table 2-4 Network Services on the Advanced Server
Service Description Supported on Advanced Servers Starts by Default Can Be Paused Can Be Stopped
Alerter Notifies selected users and computers of administrative alerts that occur on this server. Used by the server and other services. Yes Yes No Yes
Browser Lists network entities, such as domains, computers, and shared resources. Yes Yes No Yes
EventLog Records system, security, and application events in the event logs, and enables remote access to those logs. Cannot be stopped separately; stops together with the Server service. Yes Yes No No
NetLogon Verifies the user name and password of each user who attempts to log on to the network or gain access to the server. Synchronizes security databases. Yes Yes Yes Yes
Server Provides file and print sharing. Yes Yes Yes No 1
TimeSource Identifies a server as the time server for a domain. Other computers synchronize their clocks with the time server. Yes No No Yes
Replicator Replicates user directories and files. No No No No
Messenger Allows receipt of server management messages No No No No

1Only by using the PWRK$SHUTDOWN command procedure.

The Replicator and Messenger services are supported on Windows NT and can be stopped and started, but not paused, from the Advanced Server for OpenVMS.

The Alerter, NetLogon, and TimeSource services can be enabled and disabled by adding them to the list of services associated with the SrvServices server configuration parameter stored in the OpenVMS Registry, as described in Section 7.3, Managing Server Configuration Parameters Stored in the OpenVMS Registry. When a service is enabled, it is started automatically when the Advanced Server starts.


For smooth operation of the domain, HP recommends that the NetLogon service always be enabled, even on member servers. Displaying Services

As you manage your server, you may need to know the state of network services.

To display available services, use the SHOW SERVICES command. For example:


Services on server "TINMAN":

Service           Current State
--------------    ---------------
ALERTER           Started
BROWSER           Started
EVENTLOG          Started
NETLOGON          Started
SERVER            Started
TIMESOURCE        Started

   Total of 6 services


Note that the SHOW SERVICES command displays installed services only. It does not display services that have not yet been started. Starting Services

By default, the Server, Alerter, Browser, and NetLogon services are started automatically when the server is started.

To start a service, use the START SERVICE command, specifying the full service name. For example:

%PWRK-S-SVCSTART, service "TIMESOURCE" started on server "TINMAN"

LANDOFOZ\\TINMAN> Pausing Services

You can suspend execution of the Server and NetLogon services. Unlike stopping a service, pausing does not cancel resource sharing, terminate connections or change any settings associated with the service.

Pausing the Server service prevents users from making new connections to the server's shared resources; however, users who have already connected to shared resources can continue to use the resources. Pausing the Server service does not prevent users who are members of the Administrators group from connecting to the service.

Pausing the NetLogon service prevents the server from synchronizing the domain's security accounts database. The server will not validate logons.

To pause a service, use the PAUSE SERVICE command. For example:

Do you really want to pause service "SERVER" [YES or NO](YES): YES
%PWRK-S-SVCPAUSE, service "SERVER" paused on server "TINMAN"

LANDOFOZ\\TINMAN> Continuing Services

You can use the CONTINUE SERVICE command to continue a paused service. When you continue a service, you restore access to the service.

To continue a service, use the CONTINUE SERVICE command. For example:

%PWRK-S-SVCCONT, service "SERVER" continued on server "TINMAN"

LANDOFOZ\\TINMAN> Stopping Services

Stopping a service disables all operations provided by that service. You can use ADMINISTER commands to stop the following services:

  • Alerter
  • Browser
  • NetLogon
  • TimeSource

To stop the Server service, use the PWRK$SHUTDOWN.COM command procedure, as described in Section 2.3.2, Stopping the Advanced Server. Before you stop the Server service, you should follow these steps:

  1. Pause the service.
  2. Send a message to users connected to the server's shared resources, warning them that Advanced Server will be shut down. Your message should ask all users to stop their current activities and close all files. Give users adequate time to close their files before you proceed. If you shut down the server while users are accessing shared resources, they may lose data.

To stop a service, use the STOP SERVICE command. For example:

Do you really want to stop service "TIMESOURCE" [YES or NO] (YES): YES
%PWRK-S-SVCSTOP, service "TIMESOURCE" stopped on server "TINMAN"

LANDOFOZ\\TINMAN> Synchronizing Clocks on All Network Computers

You can designate an Advanced Server as the network time server in a domain by having it run the TimeSource service. Client computers on the network can synchronize their time with the time server, which makes it possible to synchronize network events. For HP OpenVMS servers, the operating system maintains the clock, which cannot be set with Advanced Server commands. (For information about changing the time or time zone for a system, see Section 2.3.5, Changing Time Zones or Daylight Saving Time Settings.

To run the TimeSource service automatically, do one of the following:

Then the TimeSource service will start automatically whenever you start the server.

To activate the TimeSource service after the server is running, use the START SERVICE TIMESOURCE command.

Previous Next Contents Index