(PYVMS LOGO) Python on OpenVMS

(go to: table of contents, index, list of vms_sys, prev: SET_SECURITY, next: SNDJBCW)


SHOW_INTRUSION - Show Intrusion Information


Format:
    status, intruder, breakin_block, context = \
        vms_sys.show_intrusion (user_criteria, [flags], [context])
Returns:
status
Condition value after return of SYS$SHOW_INTRUSION().
intruder
User specification of the matched intruder or suspect record in the intrusion database.
breakin_block
Block to receive various information in the intrusion database about a record matching the user criteria.
This is a tuple that consists of the following items:
type
Type of the matched record. Bitmasks (like CIA_M_TERMINAL) are available from the module 'vms_ciadef'.
flags
Boolean: 1 = Intruder, 0 = Suspect.
count
Number of login failures or break-in attempts made by the specified intruder or suspect.
time
Date and time when the record will expire. This is a Python long integer.
See GENMAN 'Programming', 'special OpenVMS datatypes' for details.
context
Updated context information to keep between related calls to the SYS$SHOW_INTRUSION service. The context automatically becomes invalid after some time - see the 'OpenVMS System Services Reference Manual' for details.

At least on OpenVMS VAX V6.1 this argument must always be specified. Omitting it or using 'None' results in the SS$_ACCVIO status being returned.

Arguments:
user_criteria
Description of intruder or suspect.
flags
Type of records in the intrusion database about which information is to be returned. Bitmasks (like CIA_M_INTRUDERS) are available from module 'vms_ciadef'.
context
Context information to keep between related calls to the SYS$SHOW_INTRUSION service. The context automatically becomes invalid after some time - see the 'OpenVMS System Services Reference Manual' for details.
Examples:
$ show intrusion
Intrusion       Type       Count  Expiration   Source
   NETWORK      INTRUDER      6   14:58:26.80  HERE::SYSTEM
   NETWORK      SUSPECT       1   14:57:50.33  HERE::ZESSIN
$


>>> import vms_ciadef
>>> import vms_sys
>>> 

>>> # decode type field in the breakin_block
>>> def decode_cia (bb_type):
...   if (bb_type & vms_ciadef.CIA_M_INTRUDER):
...     print 'CIA_M_INTRUDER'
...   if (bb_type & vms_ciadef.CIA_M_SUSPECT):
...     print 'CIA_M_SUSPECT'
...   if (bb_type & vms_ciadef.CIA_M_NETWORK):
...     print 'CIA_M_NETWORK'
...   if (bb_type & vms_ciadef.CIA_M_TERM_USER):
...     print 'CIA_M_TERM_USER'
...   if (bb_type & vms_ciadef.CIA_M_TERMINAL):
...     print 'CIA_M_TERMINAL'
...   if (bb_type & vms_ciadef.CIA_M_USERNAME):
...     print 'CIA_M_USERNAME'
... # decode_cia (bb_type)
...
>>>

>>> status, intruder, breakin_block, context = \
...         vms_sys.show_intrusion ('*',None, 0)
>>> print vms_sys.getmsg (status) [0]
%SYSTEM-S-NORMAL, normal successful completion
>>>
>>> print intruder
HERE::SYSTEM
>>> bb_type, bb_flags, bb_count, bb_time = breakin_block
>>> print bb_type, bb_flags, bb_count, bb_time
5 0 6 44351387068000000L
>>> print vms_sys.asctim (bb_time)
 3-JUN-1999 14:58:26.80
>>>
>>> decode_cia (bb_type)
CIA_M_INTRUDER
CIA_M_NETWORK
>>>
>>> status, intruder, breakin_block, context = \
...         vms_sys.show_intrusion ('*', None, context)
>>> print vms_sys.getmsg (status) [0]
%SYSTEM-S-NORMAL, normal successful completion
>>>
>>> print intruder
HERE::ZESSIN
>>> bb_type, bb_flags, bb_count, bb_time = breakin_block
>>> print bb_type, bb_flags, bb_count, bb_time
6 0 1 44351386703300000L
>>> print vms_sys.asctim (bb_time)
 3-JUN-1999 14:57:50.33
>>>
>>> decode_cia (bb_type)
CIA_M_SUSPECT
CIA_M_NETWORK
>>>
>>>
>>> status, intruder, breakin_block, context = \
...         vms_sys.show_intrusion ('*', None, context)
>>> print vms_sys.getmsg (status) [0]
%SYSTEM-S-NOMOREITEMS, no more items to be returned
>>>
>>> bb_type, bb_flags, bb_count, bb_time = breakin_block
>>> print bb_type, bb_flags, bb_count, bb_time
0 0 0 0L
>>>

@@ more SYS$SHOW_INTRUSION examples

(go to: table of contents, index, list of vms_sys, prev: SET_SECURITY, next: SNDJBCW)

03-JUN-1999 ZE.