Cluster I/O Protocols (CIP) Configuration and Management Manual (H06.16+, J06.05+)

-s 1.2.3.4 -d 1.2.3.6 -u any -P modp1024 -E aes
-A hmac_md5 -C deflate -restart
Configuring Transport of Authentication Events from CLIM
The CLIM Authentication Transport feature transports the authentication events from the CLIM to
the NonStop Host System. These authentication events record various security-related activities on
the CLIM. For example, events are generated by the SSHD process running on the CLIM when a
remote user attempts to log on to the CLIM. After the generation of these events on the CLIM, the
events are transported to the NonStop Host System. At the NonStop Host System, these
authentication events received from the CLIM are formatted and logged as EMS event 5239,
zcip-evt-clim-auth-event under a new EMS collector $ZCLA.
The EMS collector $ZCLA is automatically configured on the NonStop Host system as a persistent
process and is managed by the SCF KERNEL subsystem manager.
Checking the Status of the Collector $ZCLA
Issue this command to check the status of the $ZCLA collector:
$SYSTEM SYSTEM 2> scf status process $zzkrn.zcla
SCF - T9082H01 - (23JUN11) (02MAY11) - 05/02/2013 11:56:35 System \VIHAR
(C) 1986 Tandem (C) 2006 Hewlett Packard Development Company, L.P.
NONSTOP KERNEL - Status PROCESS \VIHAR.$ZZKRN.#ZCLA
Symbolic Name Name State Sub Primary Backup Owner
PID PID ID
ZCLA $ZCLA STARTED 0,383 1,380 255,255
Total Errors = 0 Total Warnings = 0
Starting the Collector
Issue this command to start the collector if the collector is in STOPPED state:
$SYSTEM SYSTEM 7> scf start process $zzkrn.zcla
SCF - T9082H01 - (23JUN11) (02MAY11) - 05/03/2013 14:58:09 System \VIHAR
(C) 1986 Tandem (C) 2006 Hewlett Packard Development Company, L.P.
KERNEL W00030 Process \VIHAR.$ZCLA started successfully.
Adding the Collector
Issue this command to add the collector with its default settings if the collector was not already
added:
ADD PROCESS $ZZKRN.ZCLA , &
AUTORESTART 5 , &
BACKUPCPU 1 , &
DEFAULTVOL $SYSTEM.ZAUDIT , &
HOMETERM $ZHOME , &
NAME $ZCLA , &
PRIMARYCPU 0 , &
PRIORITY 150 , &
PROGRAM $SYSTEM.SYSTEM.EMSACOLL , &
STARTMODE SYSTEM , &
STARTUPMSG "LOGSUBVOL $SYSTEM.ZAUDIT, SECURITY &
NUNU, LOGPREFIX C, BACKUP <BCKP—CPU>, EXT 512"
Refer to the SCF Reference Manual for the Kernel Subsystem for details on parameters, their values
and the commands to change the values of these default parameters.
Viewing the Events in the Collector $ZCLA
You can view the authentication events by using EMSDIST for the collector $ZCLA. Issue this
command:
108 CIP Configuration and Management