topic Re: OpenVMS Logs in Security

OpenVMS Logs

dale_lakes — Tue, 21 Aug 2012 19:36:00 GMT

How are OpenVMS admins gettig logs into Splunk?

Thanks in Advance.

Re: OpenVMS Logs

chris — Tue, 21 Aug 2012 20:47:26 GMT

Where I used to work we had syslog-ng listen for data that came from devices where the splunk forwarder could not be installed, we then replaced syslog-ng with splunk forwarders. We had OpenVMS Servers sending data to those machines aswell. (I'm not familiar with OpenVMS, I was the splunk admin).

Re: OpenVMS Logs

joesrepsolc — Thu, 03 Jan 2019 22:47:41 GMT

We have a linux admin that wrote some scripting that produces some .txt files on a host from OpenVMS. Then the splunk forwarder on that host monitors the directory where the .txt files land.

Pretty simple solution.

Re: OpenVMS Logs

danan5 — Fri, 26 Jul 2019 00:46:03 GMT

I didn't know anyone else has faced this issue.

The approach I have seen is drawn from:
https://support.hpe.com/hpsc/doc/public/display?docId=emr_na-c04623140

It seems the OpenVMS system send a report via email (the conduit off the box) and then dropped somewhere splunk can pick it up from.

From the OpenVMS manual (section 9.5.1)
"The most common type of report to generate is a brief, daily listing of events. You can create a command procedure that runs in a batch job every evening before midnight to generate a report of the day’s security event messages. "