User Login attempts

We have a user who has reported that his unsuccessfull audit trail report showing 3 login attempt failures on a date when he is out of office.

We want to get the client computer name which is used to login in to documentum application on the date in question. Is this value get stored in DCTM? Is there a way to get it?

Thanks,

Jeya

Find more posts tagged with

Comments

sergi

Hello, you can try the following statement:

SELECT * FROM dm_audittrail WHERE event_name='dm_logon_failure' AND user_name='username'

but if will work only if content server audits this event. (By default Content Server always audits dm_logon_failure system event), and you have View Audit extended permission.

There is a host_name attribute, that contains the host name of computer, but if you use webtop or other web-based application, you will recieve only host_name of your appserver((

p.s. sorry for my English.

Jeya

Yes this is Webtop hence host_name is our app server . User Source is LDAP. Is there any LDAP object which could help in this?

sergi

As i know, there is only one object referenced with LDAP - dm_ldap_config, But there is information about LDAP server configuration only.

As far as your problem - you can turn on tracing of ip addresses of client and server, that used for authentication. You can check Chapter 12 (Logging and tracing) of Documentum Content Server 6.5 Administration Guide (look at net_ip_addr, nettrace and trace_authenication options) for detailed info.

If that tracing options was enabled, you probably can retrieve needed information from logs.

apriam_i

Hi, sergi!

Your idea is very good.

Let me reproduse some extention of it:

SELECT dm_audittrail.object_name, time_stamp_utc FROM dm_audittrail, dm_user WHERE event_name='dm_logon_failure'
--AND user_name='username'
AND dm_user.user_name=dm_audittrail.object_name
and time_stamp_utc >= last_login_utc_time
order by 1

This query prints user names and time of wrong login attemps after successfull login.

sergi

I'm sorry, i was wrong about host_name attribute of dm_audittrail. it always contains the host name of the content server on which event was registered. It's not referenced with client's host name.

Jeya

Thank you Serji. I went through the content server guide. it is mentioned

isServerTraceOptionSet method is used to find whether a particular tracing option is set. However i am not able to find the method in the content server. Can any one guide me how to run this method in UNIX environment?

sergi

In administration guide i've found the following info:

Determining which tracing options are turned on
To determine whether a particular Content Server tracing option is on turned on, use
an IDfSession.isServerTraceOptionSet method. This method takes as an argument the
name of the option. For example, if you wish to determine if the docbroker_trace tracing
option is turned on, you would specify that option name as the argument to the method.
You cannot specify a facility name with the isServerTraceOptionSet method.

So i think, you should write a small program on Java, where you connect to content server, obtain IDfSession and call IDfSession.isServerTraceOptionSet().