Not had a play to be honest, might have to have a go though this weekend.
Sampsa
On 20 Jan 2010, at 02:10, Zane H. Healy wrote:
At 11:27 PM +0000 1/17/10, Sampsa Laine wrote:
I pulled down the 8.4 field test from HP and installed it on CHIMP, if anyone wants a play, let me know and I'll set up accounts.
Any idea how well iSCSI works? Will it work with something like FreeNAS?
Zane
--
| Zane H. Healy | UNIX Systems Administrator |
| healyzh at aracnet.com (primary) | OpenVMS Enthusiast |
| MONK::HEALYZH (DECnet) | Classic Computer Collector |
+----------------------------------+----------------------------+
| Empire of the Petal Throne and Traveller Role Playing, |
| PDP-10 Emulation and Zane's Computer Museum. |
| http://www.aracnet.com/~healyzh/ |
At 11:27 PM +0000 1/17/10, Sampsa Laine wrote:
I pulled down the 8.4 field test from HP and installed it on CHIMP, if anyone wants a play, let me know and I'll set up accounts.
Any idea how well iSCSI works? Will it work with something like FreeNAS?
Zane
--
| Zane H. Healy | UNIX Systems Administrator |
| healyzh at aracnet.com (primary) | OpenVMS Enthusiast |
| MONK::HEALYZH (DECnet) | Classic Computer Collector |
+----------------------------------+----------------------------+
| Empire of the Petal Throne and Traveller Role Playing, |
| PDP-10 Emulation and Zane's Computer Museum. |
| http://www.aracnet.com/~healyzh/ |
On Sun, 17 Jan 2010 23:27:51 +0000, you wrote:
I pulled down the 8.4 field test from HP and installed it on CHIMP, if
anyone wants a play, let me know and I'll set up accounts.
Hi! Where did you download 8.4? I've looked into the same place I told you
about the 8.3-1H1 Itanium version, but I found nothing. Is there some place
from which 8.4 can be downloaded without registering (and maybe paying) and
such? Please advice, because we are eager to have 8.4 in our DECnet! :)
Thank you very much!
G.
Guys,
I've managed to get DECNET plus going on a SIMH VAX running OpenVMS 7.3-1. It was quite straightforward actually and everything seems to be running fine. The only thing that required a bit of hacking was importing the nodes database into the local name resolver but even that wasn't TOO painful.
Let me know if anyone wants a guest account to play around with.
Sampsa
Another thing: Anyone know how to make the standard SSHD (TCP/IP services 5.4, I think) report login failures into the security journal? At the moment the Telnet and DECNET login stuff is logged, but now SSH. Any ideas?
Sampsa
On 11 Jan 2010, at 16:05, gerry77 at mail.com wrote:
On Mon, 11 Jan 2010 13:18:42 +0000, you wrote:
Gents,
I'm in the process of installing ArcSight on my network, and basically
it works by running an ANALYZE/AUDIT/FULL command on SECURITY.AUDIT
$JOURNAL and then importing the output file on a separate Unix for log
processing.
I'm trying to find a way of clearing the current audit log (since I'm
extracting the events out of it, i don't want duplicates, /SINCE risks
missing events that happen within the delta). What is the proper way
of clearing the security audit log?
What about SET AUDIT/SERVER=NEW_LOG to create a new version of the journal
before processing (i.e.: create new log then analyze the old one)? :-)
HTH,
G.
Yup, discovered that. So what I do now is to analyze the old one, put the results in the file that gets grabbed by the Unix box, and then run that SET command.
Seems to work OK so far.
Sampsa
On 11 Jan 2010, at 16:05, gerry77 at mail.com wrote:
On Mon, 11 Jan 2010 13:18:42 +0000, you wrote:
Gents,
I'm in the process of installing ArcSight on my network, and basically
it works by running an ANALYZE/AUDIT/FULL command on SECURITY.AUDIT
$JOURNAL and then importing the output file on a separate Unix for log
processing.
I'm trying to find a way of clearing the current audit log (since I'm
extracting the events out of it, i don't want duplicates, /SINCE risks
missing events that happen within the delta). What is the proper way
of clearing the security audit log?
What about SET AUDIT/SERVER=NEW_LOG to create a new version of the journal
before processing (i.e.: create new log then analyze the old one)? :-)
HTH,
G.
On Mon, 11 Jan 2010 13:18:42 +0000, you wrote:
Gents,
I'm in the process of installing ArcSight on my network, and basically
it works by running an ANALYZE/AUDIT/FULL command on SECURITY.AUDIT
$JOURNAL and then importing the output file on a separate Unix for log
processing.
I'm trying to find a way of clearing the current audit log (since I'm
extracting the events out of it, i don't want duplicates, /SINCE risks
missing events that happen within the delta). What is the proper way
of clearing the security audit log?
What about SET AUDIT/SERVER=NEW_LOG to create a new version of the journal
before processing (i.e.: create new log then analyze the old one)? :-)
HTH,
G.
Gents,
I'm in the process of installing ArcSight on my network, and basically it works by running an ANALYZE/AUDIT/FULL command on SECURITY.AUDIT$JOURNAL and then importing the output file on a separate Unix for log processing.
I'm trying to find a way of clearing the current audit log (since I'm extracting the events out of it, i don't want duplicates, /SINCE risks missing events that happen within the delta). What is the proper way of clearing the security audit log?
Sampsa
On Thu, 7 Jan 2010 11:46:38 -0500, you wrote:
I'm pretty sure there was a Session 1.1 spec. For that matter, there
were (of course) Phase V specs. The problem is that none of these seem
to have been preserved. The specs we do have are on-line because Matt
had the foresight to put them online way back when, and that stuck.
Various other specs were published, or were supposed to be published,
but that doesn't mean they are online. I suspect there are some paper
specs that could be scanned, if someone wanted to do the work.
Then there are some cases where the intent was to publish the specs --
Phase V, Phase IV+ (which is where Session 1.1 might show up) -- but I
know of no evidence that this intent was ever carried out. For example,
I've never seen any trace of the Phase V specs.
I'm wondering if someone like Al Kossow from Bitsavers has something yet to
be scanned and (re-)published. From time to time his archive has made
available very interesting things. Just to cite one, he surfaced the LAT
specification (AA-NL26A-TE) which was not available when Christine Caulfield
reverse-egineered the LAT protocol to write her latd daemon for Linux. Yet
another archive which sometimes may have interesting documents is Manx.
Speaking about protocols, one I'd like to read about is LAST (Local Area
System Transport), for which nothing appears to be available on the Internet
besides an ASCII text handbook with formatting all screwed up and just some
high level details of the protocol (that indeed resembles a glorified LAT).
By the way, the handbook part number is EK-LADLA-AS-001, and something about
DECnet-Plus is at ftp://ftp.radio-msu.net/.1/ftp.cisco.com/pub/rfc/DEC/
The names in format 1 and format 2 destination descriptors are one
example of something that was explicitly left as platform dependent.
For example, I think in VMS and RSX it is a program name, but in RSTS
(DECnet/E) it's something quite different that doesn't tie directly to a
program name at all.
In my last message I made a mistake and reversed the names: I wrote about
the destination, but I meant the source end user name. Sorry. :-P
If I'm right with my findings, the format 2 thing sent from OpenVMS V7.2 to
another identical system has the GRPCODE and USRCODE fields used as a big
four-bytes field containing the EPID of the "calling" process. And this is
not present in the V1.0 specification for the "source end user name". :-)
Bye,
G.