Phil Parker wrote:

>On Warp Connect this is in the OS/2 Peer folder as the Audit Log. The
actual executable is IBMLAN\NETPROG\LSAUDIT.EXE and the Working Directory
is IBMLAN\LOGS, both on the boot drive. i believe at least part of the data
this utility reports is encoded in the file NET.AUD in that directory. Does
anyone know the format of this file? Or where I could find out the format?
>  
>
Don't know the format , but I'd say *all* the data is in the mixed 
binary/ASCII format NET.AUD.
Here, in each record, 16-bit value at offsets  04-05 in each record is 
the encoded time, and following that at 06-07 the date as a 16-bit value 
- probably the same format as used in the DOS directory entries for the 
same purpose.

As I don't have any specific auditing logged, all the entries are 
"Change in server status" [server started in every case!]

>Is there any way to edit this log to remove some but not all records?
>  
>
Doesn't appear to be any way to do so!

>There is a "clear" menu item, but that does just what it
says: clears the
>entire log of all records.
>
>I want to remove records selectively. I looked at EWS but maybe I
didn't know what I should be looking for as I didn't see anything in a
quick once-over.
>
Hi Phil,
Were the selective removals all of specific types?
You can use the IBMLAN.INI to specify types of auditing to be done.
You could save the contents to a formatted text file and edit that!
Then clear the logfile and resume logging with selective parameters

Or do you just want to clear the failed logon attempts!  8))))))))) !

Afraid that's about all I can tell you from a quick look here.

-- 
Regards,
Mike

Failed the exam for
--------------------
MCSE - Minesweeper Consultant and Solitaire Expert
--------------------
[ISP blocks *.exe, *.cmd, *.bat, *.reg attachments]
[Please use zipped versions of above]



------------------------ Yahoo! Groups Sponsor --------------------~--> 
Make a clean sweep of pop-up ads. Yahoo! Companion Toolbar.
Now with Pop-Up Blocker. Get it for free!
http://us.click.yahoo.com/L5YrjA/eSIIAA/yQLSAA/E8folB/TM
--------------------------------------------------------------------~-> 

 
Yahoo! Groups Links

 To visit your group on the web, go to:
    http://groups.yahoo.com/group/os2user/

 To unsubscribe from this group, send an email to:
    os2user-unsubscribe{at}yahoogroups.com

 Your use of Yahoo! Groups is subject to:
    http://docs.yahoo.com/info/terms/
 


---