[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [ISSForum] Logging of SP console access



The ISS document below (see Appendix A) describes the Site Protector
Database.

http://documents.iss.net/literature/SiteProtector/technicalReference20sp4.pdf

With this you will be able to query anything that you want.

Marcelo Barcelos Ferreira
Brazil

----- Original Message ----- 
From: "Sergey V Soldatov" <SVSoldatov@xxxxxx>
To: <kfreese@xxxxxxxx>
Cc: <issforum-bounces@xxxxxxx>; "issforum@xxxxxxxxxxxxxxxx"
<issforum@xxxxxxx>
Sent: Wednesday, November 17, 2004 1:36 PM
Subject: RE: [ISSForum] Logging of SP console access


>
> You can get to know who had accessed SP through console. Try this.
>
> SELECT
>          ADT.AuditTrailID, ADT.AuditTime, ADT.Username, ADC.EventDesc,
> ADI.ParamName, ADI.ParamValue
>          from AuditTrail as ADT
> JOIN AuditInfo as ADI
>          on ADT.AuditTrailID = ADI.AuditTrailID
> JOIN AuditEventCMD as ADC
>          on ADT.AuditEventCMDID = ADC.AuditEventCMDID
> -- AuditEventCMDID 5 = console login, 6 = console logout
> WHERE ADT.AuditEventCMDID IN (5, 6)
>
> Hope it's what you need.
> Good luck!
> ---
> Best regards, Sergey V. Soldatov.
> Information security department.
>
>
>
>               "Ballerini, Jean Paul
>               (ISS EMEA)"                      To:       "Freese, Kai"
<kfreese@xxxxxxxx>,
>               <JPBallerini@xxxxxxx>
"issforum@xxxxxxxxxxxxxxxx" <issforum@xxxxxxx>
>               Sent by:                         cc:
>               issforum-bounces@xxxxxxx         Subject:  RE: [ISSForum]
Logging of SP console access
>
>
>               17.11.2004 11:05
>
>
>
>
>
>
> Kai,
>
> This is coming with SP5.
>
> Jean Paul
>
> -----Original Message-----
> From: issforum-bounces@xxxxxxxxxxxxxxxx On Behalf Of Freese, Kai
> Sent: Monday, November 15, 2004 4:15 PM
> To: issforum@xxxxxxxxxxxxxxxx
> Subject: [ISSForum] Logging of SP console access
>
> Hi all,
>
> does anybody know, is anywhere a log where I can find informations about
> who has accessed the SP console?
>
> Thanks in advance
>
> Kai
>
>
>
>
>
>
> --
> Die Information in dieser eMail ist vertraulich und kann dem
> Berufsgeheimnis unterliegen. Sie ist ausschliesslich fuer den Adressaten
> bestimmt. Jeglicher Zugriff auf diese eMail durch andere Personen als
> den Adressaten ist untersagt. Sollten Sie nicht der fuer diese eMail
> bestimmte Adressat sein, ist Ihnen jede Veroeffentlichung,
> Vervielfaeltigung oder Weitergabe wie auch das Ergreifen oder
> Unterlassen von Massnahmen im Vertrauen auf erlangte Information
> untersagt. In dieser eMail enthaltene Meinungen oder Empfehlungen
> unterliegen den Bedingungen des jeweiligen Mandatsverhaeltnisses mit dem
> Adressaten.
>
> The information in this email is confidential and may be legally
> privileged. It is intended solely for the addressee. Access to this
> email by anyone else is unauthorized. If you are not the intended
> recipient, any disclosure, copying, distribution or any action taken or
> omitted to be taken in reliance on it, is prohibited and may be
> unlawful. Any opinions or advice contained in this email are subject to
> the terms and conditions expressed in the governing KPMG client
> engagement letter.
>
> _______________________________________________
> ISSForum mailing list
> ISSForum@xxxxxxx
>
> TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
> https://atla-mm1.iss.net/mailman/listinfo/issforum
>
> To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx
>
> The ISSForum mailing list is hosted and managed by Internet Security
> Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
>
>
>
> _______________________________________________
> ISSForum mailing list
> ISSForum@xxxxxxx
>
> TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
> https://atla-mm1.iss.net/mailman/listinfo/issforum
>
> To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx
>
> The ISSForum mailing list is hosted and managed by Internet Security
> Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
>
>
>
>
>
> _______________________________________________
> ISSForum mailing list
> ISSForum@xxxxxxx
>
> TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to
https://atla-mm1.iss.net/mailman/listinfo/issforum
>
> To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx
>
> The ISSForum mailing list is hosted and managed by Internet Security
Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.
>

_______________________________________________
ISSForum mailing list
ISSForum@xxxxxxx

TO UNSUBSCRIBE OR CHANGE YOUR SUBSCRIPTION, go to https://atla-mm1.iss.net/mailman/listinfo/issforum

To contact the ISSForum Moderator, send email to mod-issforum@xxxxxxx

The ISSForum mailing list is hosted and managed by Internet Security Systems, 6303 Barfield Road, Atlanta, Georgia, USA 30328.