I'm seeing an account become locked out pretty frequently and I wanted to pull an aggregated log together of all of the lockout events so I could get a better idea of what times it's occurring. Normally I'd do this with EventCombMT.exe, but I'm in a Novell environment at the moment.
Is there a Novell equivalent to Microsoft's ALTools or another diagnostic utility I could use to help aggregate lockout events into an easy to read log file?
The Intruder Lockout events will be logged to the sys:\etc\console.log file (assuming you have CONLOG.NLM running) if running on Netware. If this is an OES2 Linux server then I think it will be in /var/log/messages.
This is a per server thing, since each possible replica server will be responsible for the lockout events.
If you had Identity Manager in the mix, you could have one driver catch all these events and do something with them, as needed.
Unfortunately, the source of the lockout will not be as clear as you would like. Server processes that are being used to login (like LDAP or perhaps CIFS or AFP) will usually show with a nonsense value, and not be helpful. Web applications can be much the same, since they will usually be doing an LDAP bind.
This works better if there are client machines making the connection over NCP (so say Client32 or the like).
