Sampsa Laine <sampsa at mac.com> writes: On 30 Nov 2013, at 22:25, "Brian Schenkenberger, VAXman-" = <system at TMESIS.COM> wrote: Sampsa Laine <sampsa at mac.com> writes: =20 =20 On 30 Nov 2013, at 22:07, "Brian Schenkenberger, VAXman-" =3D <system at TMESIS.COM> wrote: =20 Sampsa Laine <sampsa at mac.com> writes: =3D20 Just saw this on LABVAX: =3D20 %%%%%%%%%%% OPCOM 30-NOV-2013 21:28:47.27 %%%%%%%%%%% Message from user AUDIT$SERVER on LABVAX Security alarm (SECURITY) and security audit (SECURITY) on LABVAX, = =3D3D system id: 48683 Auditable event: Local interactive login failure Event time: 30-NOV-2013 21:28:47.21 PID: 22E00220 =3D3D20 Process name: _NTY215: =3D3D20 Username: <login> =3D3D20 Process owner: [SYSTEM] Terminal name: _NTY215:, =3D 122.138.48.116.static.netvigator.com Image name: =3D3D $77$DUA0:[SYS10.SYSCOMMON.][SYSEXE]LOGINOUT.EXE Status: %LOGIN-F-CMDINPUT, error reading command = =3D input =3D20 Confused as it doesn't look like a telnet logon, I thought telnet = =3D3D terminal IDs were TN-something? =3D20 sampsa <sampsa at mac.com> mobile +44 7961 149465 =3D20 Multinet installed??? =3D20 =20 Yup lol. I'm an idiot. Actually why is a Telnet login marked as LOCAL = =3D when it's marked REMOTE by UCX/TCP/IP Services? =20 Sampsa =20 I do believe there's a Multinet Server parameter to change that. = Personally, I believe it SHOULD be remote. It's one way I keep accounts safe; = access to accounts on my system to not maintain REMOTE or DIALUP. =20 Ok thanks - I was noticing this in my ArcSight monitoring box, DECNET = connections were marked as network / remote but tcp/ip were local. Need = to change that param at some point.. sampsa