XOS: Why am I seeing \UNKNOWN in the XOS Audit Report?
Below are two possible reasons "\unknown" is seen in a XOS Audit Report for node name:
A. When the EXPLICIT_NODES is OFF and you try to execute a FUP program on \one node to purge a file on another you see \UNKNOWN on the SUBJECT-SYSTEM field as shown in below;
------------------------------------------------------------------------------
XOSLOG-AUDIT
..DATE/TIME : 2019-04-23 16:23:25.732332
..SUBJECT-GROUP-NUMBER : 232
..SUBJECT-USER-NUMBER : 52
..SUBJECT-LOGIN-NAME : GROU.USER
..SUBJECT-SYSTEM : \UNKNOWN
..ELAPSED-SECONDS : 0.001240
..OBJECT-NAME : $VOL.SUBVOL.AACDB
..OBJECT-TYPE : 3
..REQUEST-TYPE : PURGE
..OPERATION : 316
..MODIFIER : 316
..TEST-FLAG : N
..WARNING-MODE : Y
..OBJECT-GROUP : XS1-MONITOR
..HOME-TERMINAL : \Exxxxxx.$X1LD.#IN
..PROCESS-DESCRIPTOR : \Exxxxxx.$Z2LJ:4307969961
..REQUESTOR-OBJECT : \Exxxxxx.$SYSTEM.SYSNN.FUP
..REQUESTOR-NAME : \Exxxxxx.$Z2LJ
..SEQUENCE-NUMBER : 638273
..RESULT : 02
..COMMENT :
FOGROUP XS1-MONITOR ACCESS YES $VOL.SUBVOL.AACDB (Warning mode)
..OSS-PATHNAME :
Solution: EXPLICIT_NODES is used to determine whether or not specific node names can be used in OSGROUP and it needs to be set to ON.
B: When REMOTE_PROCESS_LOOKUP is OFF and the access comes from a remote node, the requestor fields has \UNKNOWN.$vol.xxx
Example: ------------------------------------------------------------------------------
XOSLOG-AUDIT
..DATE/TIME : 2019-04-23 08:13:25.515208
..SUBJECT-GROUP-NUMBER : 232
..SUBJECT-USER-NUMBER : 52
..SUBJECT-LOGIN-NAME : GROU.USER
..SUBJECT-SYSTEM : \Exxxxxx
..ELAPSED-SECONDS : 0.021189
..OBJECT-NAME : $VSJU.Z.ZZ2
..OBJECT-TYPE : 3
..REQUEST-TYPE : READ
..OPERATION : 312
..MODIFIER : 300
..TEST-FLAG : N
..WARNING-MODE : Y
..OBJECT-GROUP : WARNING-MODE-TEST
..HOME-TERMINAL : \Exxxxxx.$X1LD.#IN
..PROCESS-DESCRIPTOR : \Exxxxxx.$:1:47:4307134121
..REQUESTOR-OBJECT : \UNKNOWN.$UNKNOWN.UNKNOWN.UNKNOWN
..REQUESTOR-NAME : \UNKNOWN.$UNK
..SEQUENCE-NUMBER : 823485
..RESULT : 02
..COMMENT :
FOGROUP WARNING-MODE-TEST ACCESS NO $VSJU.Z.ZZ2 (Warning mode)
..OSS-PATHNAME :
Solution: REMOTE_PROCESS_LOOKUP must be set to ON in order to determine the requestor node when it is remote.
If you are unable to locate the solution needed or if you need additional assistance please Click Here to open a case from our Customer Care Portal.
Related Articles
XOS: \UNKNOWN appears in XOS AUDIT log
Check the following entries in the OSACL. EXPLICIT_NODES OFF and REMOTE_PROCESS_LOOKUP OFF EXPLICIT_NODES should only be turned ON if you have a fast expand network and fast system at each node. Turning both ON could affect performance. It is ...
XOS: Audit records are generated even when audit is set to OFF
Check the processing time for the ruling against the PROCESSING_TIMEOUT value in the OSCONF. If the value of this keyword is set to a nonzero number and XOS takes longer than this value for responding to a request, then XOS will audit the request ...
How to resize XOS audit files
TACL> VOLUME $<VOLUME>.<XYGATEOS INSTALLATION SUBVOLUME> TACL> RUN XOS INSTALL TACL> EDIT OSCONF Edit the line AUDIT <FILENAME> EXT(<PRIMARY>, <SECONDARY>, <MAX EXTENTS>) (size of an audit trail can be controlled with the EXT option) eg: TACL> AUDIT ...
XOS: What does "Ignored PROG" mean in XOS audit?
The message means that XOS has ignored the action referenced in the audit record because there is nothing for XOS to rule on. No action is required. If you are unable to locate the solution needed or if you need additional assistance please Click ...
XOS Can XOS provide a report that shows service times for security rulings?
To set the sort order for XOS reports use the following: TACL> VOLUME <XOS Installation Volume/Subvol> TACL> XOS INSTALL TACL> XOS_REPORT Option O: Sort order Report Sort Order: Elapsed Set additional parameters and run the report using the Z or ZP ...