Auditcon

[par...@hmsy.com]

I'm running Netware 5.1 SP8. I've got auditcon running just logging
login and logout attempts only. The log is indicating a particular user
logging in continuously even though I've turned this users PC off and
disabled his account in Novell.

Any thoughts? It's filling up the log file quickly.

[Anders Gustafsson]

,

And the address reported is that one of a WS or the server?

- Anders Gustafsson, Engineer, CNE6, ASE
NSC Volunteer Sysop
Pedago, The Aaland Islands (N60 E20)

Novell does not monitor these forums officially.
Enhancement requests for all Novell products may be made at
http://support.novell.com/enhancement

Using VA 5.51 build 315 on Windows 2000 build 2600

[par...@hmsy.com]

I'm running Netware 5.1 SP8. I've got auditcon running just logging
login and logout attempts only. The log is indicating a particular user
logging in continuously even though I've turned this users PC off and
disabled his account in Novell.
Any thoughts? It's filling up the log file quickly.

And the address reported is that one of a WS or the server?

It's an address that I'm not familiar with at all on my network. It's
not an address of any of my Novell servers and the IPX network doesn't
exist here. However, I found another WS and shut it down which solved
the problem. I still am not sure what the address in auditcon is
referring to. It clearly is not an address of any machine on the
network.

[Anders Gustafsson]

,
> It's an address that I'm not familiar with at all on my network. It's
> not an address of any of my Novell servers and the IPX network doesn't
> exist here. However, I found another WS and shut it down which solved
> the problem. I still am not sure what the address in auditcon is
> referring to. It clearly is not an address of any machine on the
> network.

Can you tell us the address? Problem with AuditCon is that it can only
decode and display IPX addresses, the address you see is most likely an
IP address.

For an utility we wrote, that can display those addresses correctly, see:

http://www.caledonia.net/setaud.html

[par...@hmsy.com]

It's an address that I'm not familiar with at all on my network. It's
not an address of any of my Novell servers and the IPX network doesn't
exist here. However, I found another WS and shut it down which solved
the problem. I still am not sure what the address in auditcon is
referring to. It clearly is not an address of any machine on the
network.

Can you tell us the address? Problem with AuditCon is that it can only
decode and display IPX addresses, the address you see is most likely an
IP address.

0A230BB2:4C802E004300

[Anders Gustafsson]

,
> 0A230BB2:4C802E004300
>
That would be 10.35.11.178 IIRC. I can check my notes at work later in
the week.

[Anders Gustafsson]

Qrcheong,
> whats that IIRC refers too? I can understand that 10.35.11.178 comes
> from the first string-0A230BB2. But the next string? And what can that
> tells you?
>
IIRC = If I Recall Correctly.

Network addresses are stored as an array of bytes, ie;
* Network address type - 1 byte
* Network address length - 1 byte
* Network address - variable length

Types are 1=IPX, 2=IP (several other are used as well, ie AFP etc). You
use the type when decoding the address. Problem is that Auditcon only
knows IPX and thus never checks the address type, so in your example it
tries to decode an IP address as an IPX one, ie network:node. The node
part is undefined for an IP address so in your example:

0A230BB2:4C802E004300

0A230BB2 = IP Address
4C802E004300 = Garbage

If you use SetAud, then it decodes those addresses correctly.

- Anders Gustafsson (Sysop)

The Aaland Islands (N60 E20)

Novell has a new enhancement request system,
or what is now known as the requirement portal.
If customers would like to give input in the upcoming
releases of Novell products then they should go to
http://www.novell.com/rms