Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm seeing an account become locked out pretty frequently and I wanted to pull an aggregated log together of all of the lockout events so I could get a better idea of what times it's occurring. Normally I'd do this with EventCombMT.exe, but I'm in a Novell environment at the moment.

Is there a Novell equivalent to Microsoft's ALTools or another diagnostic utility I could use to help aggregate lockout events into an easy to read log file?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

The Intruder Lockout events will be logged to the sys:\etc\console.log file (assuming you have CONLOG.NLM running) if running on Netware. If this is an OES2 Linux server then I think it will be in /var/log/messages.

This is a per server thing, since each possible replica server will be responsible for the lockout events.

If you had Identity Manager in the mix, you could have one driver catch all these events and do something with them, as needed.

Unfortunately, the source of the lockout will not be as clear as you would like. Server processes that are being used to login (like LDAP or perhaps CIFS or AFP) will usually show with a nonsense value, and not be helpful. Web applications can be much the same, since they will usually be doing an LDAP bind.

This works better if there are client machines making the connection over NCP (so say Client32 or the like).

share|improve this answer
    
Yep, CIFS-generated lockout events do list the server (not the client) address as the address-source for the lockout. At least on NetWare. –  sysadmin1138 Jan 3 '11 at 17:45
    
I'm looking for events that would show up as a type 2 (local interactive) logon in a pure AD environment. Is that something that I'll be able to see? –  bshacklett Jan 4 '11 at 13:13
    
You can use the Audit instrumentation to try and collect these events. But it would be per server and need to be collated. You would need something to collect them. I am not sure what else can receive the events other than the Novell audit tools. –  geoffc Jan 4 '11 at 15:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.