[HECnet] VMS question - clearing the SECURITY.AUDIT$JOURNAL security log

[Sampsa Laine]

Yup, discovered that. So what I do now is to analyze the old one, put the results in the file that gets grabbed by the Unix box, and then run that SET command.

Seems to work OK so far.

Sampsa

On 11 Jan 2010, at 16:05, gerry77 at mail.com wrote:

On Mon, 11 Jan 2010 13:18:42 +0000, you wrote:

Gents,

I'm in the process of installing ArcSight on my network, and basically
it works by running an ANALYZE/AUDIT/FULL command on SECURITY.AUDIT
$JOURNAL and then importing the output file on a separate Unix for log
processing.

I'm trying to find a way of clearing the current audit log (since I'm
extracting the events out of it, i don't want duplicates, /SINCE risks
missing events that happen within the delta). What is the proper way
of clearing the security audit log?

What about SET AUDIT/SERVER=NEW_LOG to create a new version of the journal
before processing (i.e.: create new log then analyze the old one)? :-)

HTH,
G.