1 ANALYZE
The ANALYZE commands invoke utilities to examine various components of an OpenVMS system. They perform the following functions: o Invoke the Audit Analysis Utility to extract selective information from the system security audit journal (see /AUDIT). o Invoke the System Dump Analyzer (SDA) to examine the specified dump file (see /CRASH_DUMP). o Invoke the Analyze/Disk_Structure Utility to examine disk volumes (see /DISK_STRUCTURE). o Invoke the Errorlog Report Formatter to selectively report the contents of an error log file (see /ERROR_LOG). o Describe the contents of an image file or shareable image file (see /IMAGE). o Invoke the Bad Utility to find disk blocks that cannot be used to store data (see /MEDIA). o Describe the contents of an object file (see /OBJECT). o Invoke the OpenVMS Debugger for analysis of a process dump file (see /PROCESS_DUMP). o Analyze the internal structure of an RMS file (see /RMS_FILE). o Invoke the SDA to examine the running system (see /SYSTEM). The default analyze function is to examine object modules (ANALYZE/OBJECT). 2 /AUDIT The Audit Analysis utility (ANALYZE/AUDIT) processes event messages in security audit log files to produce reports of security-related events on the system. Format ANALYZE/AUDIT [file-spec[,...]] 3 Qualifiers Qualifier Description /BEFORE Controls whether records dated earlier than the specified time are selected /BINARY Controls whether output is a binary file /BRIEF Controls whether a brief, single-line record format is used in ASCII displays /EVENT_TYPE Selects the classes of events to be extracted from the security log file /FULL Controls whether a full format is used in ASCII displays /IGNORE Excludes records from the report that match the specified criteria /INTERACTIVE Controls whether interactive command mode is enabled when the Audit Analysis utility is invoked /OUTPUT Specifies where to direct output from the Audit Analysis utility /PAUSE Specifies the length of time each record is displayed in a full format display /SELECT Specifies the criteria for selecting records /SINCE Indicates that the utility must operate on records dated with the specified time or after the specified time /SUMMARY Specifies that a summary of the selected records be produced after all records are processed 3 /BEFORE Controls whether records dated earlier than the specified time are selected. Format /BEFORE[=time] /NOBEFORE time Specifies the time used to select records. Records dated earlier than the specified time are selected. You can specify an absolute time, delta time, or a combination of the two. Observe the syntax rules for date and time described in the OpenVMS User's Manual. 4 Examples 1.$ ANALYZE/AUDIT /BEFORE=25-NOV-1994 - _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example selects all records dated earlier than November 25, 1994. 2.$ ANALYZE/AUDIT /BEFORE=14:00/SINCE=12:00 - _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example selects all records generated between noon and 2 P.M. today. 3 /BINARY Controls whether output is a binary file. Format /BINARY /NOBINARY 4 Example $ ANALYZE/AUDIT /BINARY/SINCE=TODAY/OUTPUT=25DEC94.AUDIT - _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example selects all audit records generated today and writes the records in binary format to 25DEC94.AUDIT. 3 /BRIEF Controls whether a brief, single-line record format is used in ASCII displays. Format /BRIEF (default) 4 Example $ ANALYZE/AUDIT /OUTPUT=AUDIT.LIS - _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example produces an ASCII file in brief format by default. The report is written to the AUDIT.LIS file. 3 /EVENT_TYPE Selects the classes of events to be extracted from the security log file. If you omit the qualifier or specify the ALL keyword, the utility includes all enabled event classes in the report. Format /EVENT_TYPE=(event-type[,...]) event type[,...] Specifies the classes of events used to select records. You can specify any of the following event types: [NO]ACCESS Access to an object, such as a file [NO]ALL All event types [NO]AUDIT Use of the SET AUDIT command [NO]AUTHORIZATION Change to the authorization database (SYSUAF.DAT, RIGHTSLIST.DAT, NETPROXY.DAT, or NET$PROXY.DAT) [NO]BREAKIN Break-in detection [NO]CONNECTION Establishment of a network connection through the OpenVMS System Management utility (SYSMAN), DECwindows, or interprocess communication (IPC) software or DECnet Phase IV (VAX only) [NO]CREATE Creation of an object [NO]DEACCESS Completion of access to an object [NO]DELETE Deletion of an object [NO]INSTALL Modification of the known file list with the Install utility (INSTALL) [NO]LOGFAIL Unsuccessful login attempt [NO]LOGIN Successful login [NO]LOGOUT Successful logout [NO]MOUNT Execution of DCL commands MOUNT or DISMOUNT [NO]NCP Modification of the DECnet network configuration databases [NO]NETPROXY Modification of the network proxy authorization file (NETPROXY.DAT or NET$PROXY.DAT) [NO]PRIVILEGE Privilege auditing [NO]PROCESS Use of one or more of the process control system services: $CREPRC, $DELPRC, $SCHDWK, $CANWAK, $WAKE, $SUSPND, $RESUME, $GRANTID, $REVOKID, $GETJPI, $FORCEX, $SETPRI [NO]RIGHTSDB Modification of the rights database (RIGHTSLIST.DAT) [NO]SYSGEN Modification of system parameters through the System Generation utility (SYSGEN) or AUTOGEN [NO]SYSUAF Modification of the system user authorization file (SYSUAF.DAT) [NO]TIME Change in system or cluster time Specifying the negated form of an event class (for example, NOLOGFAIL) excludes the specified event class from the audit report. 4 Examples 1.$ ANALYZE/AUDIT/EVENT_TYPE=LOGFAIL - _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example extracts all records of unsuccessful login attempts, which match the LOGFAIL class, and compiles a brief report. 2.$ ANALYZE/AUDIT/EVENT_TYPE=(NOLOGIN,NOLOGOUT) - _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example builds a report in brief format of all audit records except those in the LOGIN and LOGOUT event classes. 3 /FULL Controls whether a full format is used in ASCII displays. If you specify /NOFULL or omit the qualifier, records are displayed in the brief format. Format /FULL /NOFULL (default) 4 Example $ ANALYZE/AUDIT /FULL - _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example displays the full contents of each selected record. 3 /IGNORE Excludes records from the report that match the specified criteria. Format /IGNORE=criteria[,...] criteria[,...] Specifies that all records are selected except those matching any of the specified exclusion criteria. See the /SELECT qualifier description for a list of the possible criteria to use with the /IGNORE qualifier. 4 Example $ ANALYZE/AUDIT/IGNORE=(SYSTEM=NAME=WIPER,USERNAME=MILANT) - _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example excludes from the audit analysis report all records in the audit log file generated from node WIPER or from user MILANT (on any node). 3 /INTERACTIVE Controls whether interactive command mode is enabled when the Audit Analysis utility is invoked. Format /INTERACTIVE (default) /NOINTERACTIVE 4 Examples 1.$ ANALYZE/AUDIT/FULL - _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example produces a full format display of the selected records. New records are displayed every 3 seconds. (See the /PAUSE qualifier description to find how to modify the duration of each record display.) Press Ctrl/C to interrupt the display and to enter interactive commands. 2.$ ANALYZE/AUDIT/FULL/NOINTERACTIVE - _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example invokes the utility in noninteractive mode. It displays the first record selected and prompts you to press the Return key to display each additional selected record. Control returns to the DCL command level when all selected records have been displayed. 3 /OUTPUT Specifies where to direct output from the Audit Analysis utility (ANALYZE/AUDIT). If you omit the qualifier, the report is sent to SYS$OUTPUT. Format /OUTPUT[=file-spec] /NOOUTPUT file-spec[,...] Specifies the name of the file that is to contain the selected records. If you omit the device and directory specification, the utility uses the current device and directory specification. If you omit the file name and type, the default file name AUDIT.LIS is used. If the output is binary (/BINARY) and you omit the /OUTPUT qualifier, the binary information is written to the file AUDIT.AUDIT$JOURNAL. 4 Example $ ANALYZE/AUDIT /BINARY/OUTPUT=BIN122588.DAT - _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example selects audit records from the system audit log file and writes them to the binary file BIN122588.DAT. 3 /PAUSE Specifies the length of time each record is displayed in a full- format display. Format /PAUSE=seconds seconds Specifies the duration (in seconds) of the full-screen display. A value of 0 specifies that the system should not pause before displaying the next record. By default, the utility displays a record for 3 seconds. 4 Example $ ANALYZE/AUDIT /FULL/PAUSE=1 - _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example displays a selected record in full format every second. You can interrupt the display and enter interactive commands at any time by pressing Ctrl/C. 3 /SELECT Specifies the criteria for selecting records from the audit log file. See the OpenVMS Guide to System Security for a description of how to generate audit records. Format /SELECT=criteria[,...] /NOSELECT criteria[,...] Specifies the criteria for selecting records. For each specified criterion, ANALYZE/AUDIT has two selection requirements: o The packet corresponding to the criterion must be present in the record. o One of the specified values must match the value in that packet. For example, if you specify the criteria (USER=(PUTNAM,WU),SYSTEM=DBASE), ANALYZE/AUDIT selects an event record containing the SYSTEM=DBASE packet and a USER packet with either the PUTNAM value or the WU value. If you omit the /SELECT qualifier, all event records selected through the /EVENT_TYPE qualifier are extracted from the audit log file and included in the report. You can specify any of the following criteria shown in Additional topics: 4 ACCESS ACCESS=(type,...) Specifies the type of object access upon which the selection is based. Access is object-specific and includes the following types: Associate Execute Read Control Lock Submit Create Logical Use Delete Manage Write Physical The OpenVMS Guide to System Security describes each of these types. 4 ACCOUNT ACCOUNT=(name,...) Specifies the account name upon which selection is based. You can use wildcards, such as an asterisk (*) or percent sign (%), to represent all or part of the name. 4 ALARM_NAME ALARM_NAME=(alarm-name,...) Specifies the alarm journal name on which selection is based. You can use wildcards to represent all or part of the alarm name. 4 ASSOCIATION_NAME ASSOCIATION_NAME=(IPC-name,...) Specifies the name of the interprocess communication (IPC) association. 4 AUDIT_NAME AUDIT_NAME=(journal-name,...) Specifies the audit journal name on which selection is based. You can use wildcards to represent all or part of the audit journal name. 4 COMMAND_LINE COMMAND_LINE=(command,...) Specifies the command line that the user entered. 4 CONNECTION_IDENTIFICATION CONNECTION_IDENTIFICATION=(IPC-name,...) Specifies the name for the interprocess communication (IPC) connection. 4 DECNET_LINK_IDENTIFICATION DECNET_LINK_IDENTIFICATION=(value,...) Specifies the number of the DECnet logical link. 4 DECNET_OBJECT_NAME DECNET_OBJECT_NAME=(object-name,...) Specifies the name of the DECnet object. 4 DECNET_OBJECT_NUMBER DECNET_OBJECT_NUMBER=(value,...) Specifies the number of the DECnet object. 4 DEFAULT_USERNAME DEFAULT_USERNAME=(username,...) Specifies the default local user name for incoming network proxy requests. 4 DEVICE_NAME DEVICE_NAME=(device-name,...) Specifies the name of a device in audit records that have a DEVICE_NAME packet. Note that this does not select the device name when it occurs in other packet types, such as in a file name or in the TARGET_DEVICE_NAME packet. 4 DIRECTORY_ENTRY DIRECTORY_ENTRY=(directory,...) Specifies the directory entry associated with file system operation. 4 DIRECTORY_NAME DIRECTORY_NAME=(directory,...) Specifies the name of the directory file. 4 DISMOUNT_FLAGS DISMOUNT_FLAGS=(flag-name,...) Identifies the names of the volume dismounting flags to be used in selecting records. Specify one or more of the following flag names: Abort, Cluster, Nounload, and Unit. 4 EVENT_CLUSTER_NAME EVENT_CLUSTER_NAME=(event-flag-cluster-name,...) Specifies the name of the event flag cluster. 4 FACILITY FACILITY=(facility-name,...) Specifies that only events audited by the named facility be selected. Provide a name or a number but, in either case, the facility has to be defined through the logical AUDSERV$FACILITY_ NAME as a decimal number; the system uses the number 0. 4 FIELD_NAME FIELD_NAME=(field-name,...) Specifies the name of the field that was modified. ANALYZE /AUDIT uses the FIELD_NAME criterion with packets containing the original data and the new data (specified by the NEW_DATA criterion). 4 FLAGS FLAGS=(flag-name,...) Identifies the names of the audit event flags associated with the audited event. These names should be used in selecting records. Specify one or more of the following flags: ACL, Alarm, Audit, Flush, Foreign, Internal, and Mandatory. 4 HOLDER HOLDER=keyword(,...) Specifies the characteristics of the identifier holder to be used when selecting event records. Choose from the following keywords: NAME=username Specifies the name of the holder. You can represent all or part of the name with a wildcard. OWNER=uic Specifies the user identification code (UIC) of the holder. 4 IDENTIFIER IDENTIFIER=keyword(,...) Identifies which attributes of an identifier should be used when selecting event records. Choose from the following keywords: ATTRIBUTES=name Specifies the name of the particular attribute. Valid attribute names are as follows: Dynamic, Holder_Hidden, Name_ Hidden, NoAccess, Resource, and Subsystem. NAME=identifier Specifies the original name of the identifier. You can represent all or part of the name with a wildcard. NEW_NAME=identifier Specifies the new name of the identifier. You can represent all or part of the name with a wildcard. NEW_ATTRIBUTES=name Specifies the name of the new attribute. Valid attribute names are Dynamic, Holder_ Hidden, Name_Hidden, NoAccess, Resource, and Subsystem. VALUE=value Specifies the original value of the identifier. NEW_VALUE=value Specifies the new value of the identifier. 4 IDENTIFIERS_MISSING IDENTIFIERS_MISSING=(identifier,...) Specifies the identifiers missing in a failure to access an object. 4 IDENTIFIERS_USED IDENTIFIERS_USED=(identifier,...) Specifies the identifiers used to gain access to an object. An event record matches if the specified list is a subset of the identifiers recorded in the event record. 4 IMAGE_NAME IMAGE_NAME=(image-name,...) Identifies the name of the image to be used when selecting event records. You can represent all or part of the image name with a wildcard. 4 INSTALL INSTALL=keyword(,...) Specifies that installation event packets are to be considered when selecting event records. Choose from the following keywords: FILE=filename Specifies the name of the installed file. You can represent all or part of the name with a wildcard. Note that on Alpha systems prior to Version 6.1 and on VAX systems prior to Version 6.0, audit log files record the installed file name within an object name packet. To select the installed file, you must use the expression OBJECT=(NAME=filename) instead of FILE=filename. FLAGS=flag-name Specifies the names of the flags, which correspond to qualifiers of the Install utility (INSTALL); for example, OPEN corresponds to /OPEN. PRIVILEGES=privilege- Specifies the names of the privileges with name which the file was installed. 4 LNM_PARENT_NAME LNM_PARENT_NAME=(table-name,...) Specifies the name of the parent logical name table. 4 LNM_TABLE_NAME LNM_TABLE_NAME=(table-name,...) Specifies the name of the logical name table. 4 LOCAL LOCAL=(characteristic,...) Specifies the characteristics of the local (proxy) account to be used when selecting event records. The following characteristic is supported: USERNAME=username Specifies the name of the local account. You can represent all or part of the name with a wildcard. 4 LOGICAL_NAME LOGICAL_NAME=(logical-name,...) Specifies the logical name of the mounted (or dismounted) volume upon which selection is based. You can represent all or part of the logical name with a wildcard. 4 MAILBOX_UNIT MAILBOX_UNIT=(number,...) Specifies the number of the mailbox unit. 4 MOUNT_FLAGS MOUNT_FLAGS=(flag-name,...) Specifies the names of the volume mounting flags upon which selection is based. Possible flag names include the following: CACHE=(NONE,WRITETHROUGH) CD-ROM CLUSTER COMPACTION DATACHECK=(READ,WRITE) DSI FOREIGN GROUP INCLUDE INITIALIZATION=(ALLOCATE,CONTINUATION) MESSAGE NOASSIST NOAUTOMATIC NOCOMPACTION NOCOPY NOHDR3 NOJOURNAL NOLABEL NOMOUNT_VERIFICATION NOQUOTA NOREBUILD NOUNLOAD NOWRITE { ACCESSIBILITY } { EXPIRATION } { IDENTIFICATION } { } { LIMITED_SEARCH } OVERRIDE=(options[,...]) { LOCK } { NO_FORCED_ERROR } { } { OWNER_IDENTIFIER } { SECURITY } { SETID } { } QUOTA SHARE SUBSYSTEM SYSTEM TAPE_DATA_WRITE XAR 4 NEW_DATA NEW_DATA=(value,...) Specifies the value to use after the event occurs. Use this criterion with the FIELD_NAME criterion.) 4 NEW_IMAGE_NAME NEW_IMAGE_NAME=(image-name,...) Specifies the name of the image to be activated in the newly created process, as supplied to the $CREPRC system service. 4 NEW_OWNER NEW_OWNER=(uic,...) Specifies the user identification code (UIC) to be assigned to the created process, as supplied to the $CREPRC system service. 4 OBJECT OBJECT=keyword(,...) Specifies which characteristics of an object should be used when selecting event records. Choose any of the following keywords: CLASS=class-name Specifies the general object class as one of the following: Capability Device Event_cluster File Group_global_section Logical_name_table Queue Resource_domain Security_class System_global_section Volume You must enter the full class name (for example, CLASS=logical_name_table) or use wildcard characters to supply a portion of the class name (for example, CLASS=log*). NAME=object-name Specifies the name of the object. You can represent all or part of the name with a wildcard. If you do not use a wildcard, specify the full object name (for example, BOSTON$DUA0:[RWOODS]MEMO.MEM;1). OWNER=value Specifies the UIC or general identifier of the object. TYPE=type Specifies the general object class (type of object). The available classes are as follows: Capability Device File Group_global_section Logical_name_table Queue System_global_section The CLASS keyword supersedes the TYPE keyword. However, TYPE is required to select audit records in files created prior to OpenVMS Alpha Version 6.1 and OpenVMS VAX Version 6.0. 4 PARENT PARENT=keyword(,...) Specifies which characteristics of the parent process are used when selecting event records generated by a subprocess. Choose from the following keywords: IDENTIFICATION=value Specifies the process identification (PID) of the parent process. NAME=process-name Specifies the name of the parent process. You can represent all or part of the name with a wildcard. OWNER=value Specifies the owner (identifier value) of the parent process. USERNAME=username Specifies the user name of the parent process. You can represent all or part of the name with a wildcard. 4 PASSWORD PASSWORD=(password,...) Specifies the password used when the system detected a break-in attempt. 4 PRIVILEGES_MISSING PRIVILEGES_MISSING=(privilege-name,...) Specifies privileges the caller needed to perform the operation successfully. Specify any of the system privileges, as described in the OpenVMS Guide to System Security. 4 PRIVILEGES_USED PRIVILEGES_USED=(privilege-name,...) Specifies the privileges of the process to be used when selecting event records. Specify any of the system privileges, as described in the OpenVMS Guide to System Security. Also include the STATUS keyword in the selection criteria so the report can demonstrate whether the privilege was involved in a successful or an unsuccessful operation. 4 PROCESS PROCESS=(characteristic,...) Specifies the characteristics of the process to be used when selecting event records. Choose from the following characteristics: IDENTIFICATION=value Specifies the PID of the process. NAME=process-name Specifies the name of the process. You can represent all or part of the name with a wildcard. 4 REMOTE REMOTE=keyword(,...) Specifies that some characteristic of the network request is to be used when selecting event records. Choose from the following keywords: ASSOCIATION_ Specifies the interprocess communication NAME=IPC-name (IPC) association name. LINK_ Specifies the number of the DECnet logical IDENTIFICATION=value link. IDENTIFICATION=value Specifies the DECnet node address. NODENAME=node-name Specifies the DECnet node name. You can represent all or part of the name with a wildcard. USERNAME=username Specifies the remote user name. You can represent all or part of the remote user name with a wildcard. 4 REQUEST_NUMBER REQUEST_NUMBER=(value,...) Specifies the request number associated with the DCL command REQUEST/REPLY. 4 SECTION_NAME SECTION_NAME=(global-section-name,...) Specifies the name of the global section. 4 SNAPSHOT_BOOTFILE SNAPSHOT_BOOTFILE=(filename,...) Specifies the name of the file containing a snapshot of the system. 4 SNAPSHOT_SAVE_FILENAME SNAPSHOT_SAVE_FILENAME=(filename,...) Specifies the name of the system snapshot file for a save operation that is in progress. 4 STATUS STATUS=type(,...) Specifies the type of success status to be used when selecting event records. Choose from the following status types: SUCCESSFUL Specifies any success status. FAILURE Specifies any failure status. CODE=(value,...) Specifies a specific completion status. 4 SUBJECT_OWNER SUBJECT_OWNER=(uic,...) Specifies the owner (UIC) of the process causing the event. 4 SYSTEM SYSTEM=keyword(,...) Specifies the characteristics of the system to be used when selecting event records. Choose from the following keywords: IDENTIFICATION=value Specifies the numeric identification of the system. NAME=nodename Specifies the node name of the system. 4 SYSTEM_SERVICE_NAME SYSTEM_SERVICE_NAME=(service-name,...) Specifies the name of the system service associated with the event. 4 TARGET_DEVICE_NAME TARGET_DEVICE_NAME=(device-name,...) Specifies the target device name used by a process control system service. 4 TARGET_PROCESS_IDENTIFICATION TARGET_PROCESS_IDENTIFICATION=(value,...) Specifies the target process identifier (PID) used by a process control system service. 4 TARGET_PROCESS_NAME TARGET_PROCESS_NAME=(process-name,...) Specifies the target process name used by a process control system service. 4 TARGET_PROCESS_OWNER TARGET_PROCESS_OWNER=(uic,...) Specifies the target process owner (UIC) used by a process control system service. 4 TARGET_USERNAME TARGET_USERNAME=(username,...) Specifies the target user name used by a process control system service. 4 TERMINAL TERMINAL=(device-name,...) Specifies the name of the terminal to be used when selecting event records. You can represent all or part of the terminal name with a wildcard. 4 TRANSPORT_NAME TRANSPORT_NAME=(transport-name,...) Specifies the name of the transport: interprocess communication (IPC) or System Management Integrator (SMI), which handles requests from the System Management utility. On VAX systems, it also can also specify the DECnet transport name (NSP). 4 UAF_ADD UAF_ADD=(record-name,...) Specifies the name of the authorization record being added. 4 UAF_COPY UAF_COPY=(record-name,...) Specifies the original and new names of the authorization record being copied. 4 UAF_DELETE UAF_DELETE=(record-name,...) Specifies the name of the authorization record being removed. 4 UAF_MODIFY UAF_MODIFY=(record-name,...) Specifies the name of the authorization record being modified. 4 UAF_RENAME UAF_RENAME=(record-name,...) Specifies the name of the authorization record being renamed. 4 UAF_SOURCE UAF_SOURCE=(record-name,...) Specifies the user name of the source record for an Authorize utility (AUTHORIZE) copy operation. 4 USERNAME USERNAME=(username,...) Specifies the user name to be used when selecting event records. You can represent all or part of the user name with a wildcard. 4 VOLUME_NAME VOLUME_NAME=(volume-name,...) Specifies the name of the mounted (or dismounted) volume to be used when selecting event records. You can represent all or part of the volume name with a wildcard. 4 VOLUME_SET_NAME VOLUME_SET_NAME=(volume-set-name,...) Specifies the name of the mounted (or dismounted) volume set to be used when selecting event records. You can represent all or part of the volume set name with a wildcard. 4 Examples 1.$ ANALYZE/AUDIT /FULL/SELECT=USERNAME=JOHNSON - _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example selects all records written to the security audit log file that were generated by user JOHNSON. 2.$ ANALYZE/AUDIT/FULL/SELECT=PRIVILEGES_USED=(SYSPRV,- _$ BYPASS) SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example selects all records written to the security audit log file that were generated by events through the use of either SYSPRV or BYPASS privilege. 3 /SINCE Indicates the utility must operate on records dated with the specified time or after the specified time. Format /SINCE[=time] /NOSINCE time Specifies the time used to select records. Records dated the same or later than the specified time are selected. You can specify an absolute time, a delta time, or a combination of the two. Observe the syntax rules for date and time described in the OpenVMS User's Manual. If you specify /SINCE without the time, the utility uses the beginning of the current day. 4 Examples 1.$ ANALYZE/AUDIT /SINCE=25-JUL-1994 - _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example selects records dated later than July 25, 1994. 2.$ ANALYZE/AUDIT /SINCE=25-JUL-1994:15:00 - _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example selects records written after 3 P.M. on July 25, 1994. 3 /SUMMARY Specifies that a summary of the selected records be produced after all records are processed. You can use the /SUMMARY qualifier alone or in combination with the /BRIEF, the /BINARY, or the /FULL qualifier. Format /SUMMARY=presentation /NOSUMMARY presentation Specifies the presentation of the summary. If you do not specify a presentation criterion, ANALYZE/AUDIT summarizes the number of audits. You can specify either of the following presentations: COUNT Lists the total number of audit messages for each class of security event that have been extracted from the security audit log file. This is the default. PLOT Displays a plot showing the class of the audit event, the time of day when the audit was generated, and the name of the system where the audit was generated. 4 Examples 1.$ ANALYZE/AUDIT/FULL/EVENT_TYPE=(BREAKIN,LOGFAIL)/SUMMARY- _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL The command in this example generates a full format listing of all logged audit messages that match the break-in or log failure event classes. A summary report is included at the end of the listing. 2.$ ANALYZE/AUDIT/FULL/EVENT_TYPE=(BREAKIN,LOGFAIL)/SUMMARY=PLOT - _$ SYS$MANAGER:SECURITY.AUDIT$JOURNAL This command generates a histogram that you can display on a character-cell terminal. 2 /CRASH_DUMP Invokes the System Dump Analyzer (SDA) utility to analyze a specified dump file. You can use SDA to help determine the causes of system failures. This utility is also useful for examining the running system by using the DCL command ANALYZE/SYSTEM. Format ANALYZE [ /CRASH_DUMP [/RELEASE] filespec ] [ /CRASH_DUMP [/SYMBOL=system-symbol-table ] filespec ] filespec Name of the crash dump file to be analyzed. The default file specification is: SYS$DISK:[default-dir]SYSDUMP.DMP SYS$DISK and [default-dir] represent the disk and directory specified in your last SET DEFAULT command. If you do not specify filespec, SDA prompts you for it. 3 /RELEASE Invokes SDA to release those blocks in the specified system paging file occupied by a crash dump. Format /RELEASE filespec filespec Name of the system paging file (SYS$SYSTEM:PAGEFILE.SYS). The default file specification is: SYS$DISK:[default-dir]SYSDUMP.DMP SYS$DISK and [default-dir] represent the disk and directory specified in your last SET DEFAULT command. If you do not specify filespec, SDA prompts you for it. 4 Description Use the /RELEASE qualifier to release from the system paging file those blocks occupied by a crash dump. Be aware that when you use the /RELEASE qualifier, SDA immediately deletes the dump from the paging file and allows you no opportunity to analyze its contents. When you specify the /RELEASE qualifier in the ANALYZE command, do the following: 1. Use the /CRASH_DUMP qualifier. 2. Include the name of the system paging file (SYS$SYSTEM:PAGEFILE.SYS) as the filespec. If you do not specify the system paging file or the specified paging file does not contain a dump, SDA displays one of the following messages: %SDA-E-BLKSNRLSD, no dump blocks in page file to release, or no page file %SDA-E-NOTPAGFIL, specified file is not the page file 4 Example $ ANALYZE/CRASH_DUMP/RELEASE SYS$SYSTEM:PAGEFILE.SYS $ ANALYZE/CRASH/RELEASE PAGEFILE.SYS Either of these commands invokes SDA to release to the paging file those blocks in SYS$SYSTEM:PAGEFILE.SYS occupied by a crash dump. 3 /SYMBOL Specifies a system symbol table for SDA to use in place of the default system symbol table, SYS$SYSTEM:SYS.STB. Format /SYMBOL =system-symbol-table system-symbol-table File specification of the SDA system symbol table required by SDA to analyze a system dump. The specified system-symbol- table must contain those symbols required by SDA to find certain locations in the executive image. If you do not specify the /SYMBOL qualifier, SDA uses SYS$SYSTEM:SYS.STB by default. If you do not specify the /SYMBOL qualifier, SDA uses SYS$SYSTEM:SYS.STB by default. When you do specify the /SYMBOL qualifier, SDA assumes the default disk and directory to be SYS$DISK; that is, the disk and directory specified in your last SET DEFAULT command. If you specify a file for this parameter that is not a system symbol table, SDA halts with a fatal error. 4 Description The /SYMBOL qualifier allows you to specify a system symbol table other than SYS$SYSTEM:SYS.STB to load into the SDA symbol table. This might be necessary, for instance, to analyze a crash dump taken on a processor running a different version of OpenVMS. You can use the /SYMBOL qualifier whether you are analyzing a system dump or a running system. 4 Example $ ANALYZE/CRASH_DUMP/SYMBOL=SYS$CRASH:SYS.STB SYS$SYSTEM This command invokes SDA to analyze the crash dump stored in SYS$SYSTEM:SYSDUMP.DMP, using the system symbol table at SYS$CRASH:SYS.STB. 3 Examples 1. $ ANALYZE/CRASH_DUMP SYS$SYSTEM:CRASHDUMP.DMP This command invokes SDA to analyze the crash dump stored in SYS$SYSTEM:CRASHDUMP.DMP. 2. $ ANALYZE/CRASH SYS$SYSTEM:PAGEFILE.SYS This command invokes SDA to analyze a crash dump stored in the system paging file. 2 /DISK_STRUCTURE The Analyze/Disk_Structure utility checks the readability and validity of Files-11 Structure Level 1 and Structure Level 2 disk volumes, and reports errors and inconsistencies. You can detect most classes of errors by invoking the utility once and using its defaults. Format ANALYZE/DISK_STRUCTURE device-name:[/qualifier] 3 Parameter device-name Specifies the disk volume or volume set to be verified. If you specify a volume set, all volumes of the volume set must be mounted as Files-11 volumes. For information on the Mount utility, refer to the OpenVMS System Management Utilities Reference Manual: M-Z. 3 Qualifiers /CONFIRM Determines whether the Analyze/Disk_Structure utility prompts you to confirm each repair. If you respond with Y or YES, the utility performs the repair. Otherwise, the repair is not performed. Format /[NO]CONFIRM /HOMEBLOCKS Erases home blocks from a volume whose home blocks were not deleted during previous initialization operations. Format /HOMEBLOCKS /LIST Determines whether the Analyze/Disk_Structure utility produces a listing of the index file. Format /LIST[=filespec] /NOLIST /OUTPUT Specifies the output file to which the Analyze/Disk_Structure utility is to write the disk structure errors. Format /[NO]OUTPUT[=filespec] /READ_CHECK Determines whether the Analyze/Disk_Structure utility performs a read check of all allocated blocks on the specified disk. When the Analyze/Disk_Structure utility performs a read check, it reads the disk twice; this ensures that it reads the disk correctly. The default is /NOREAD_CHECK. Format /[NO]READ_CHECK /RECORD_ATTRIBUTES Determines whether the Analyze/Disk_Structure utility repairs files containing erroneous settings in the record attributes section of their associated file attribute block (FAT). Format /RECORD_ATTRIBUTES /REPAIR Determines whether the Analyze/Disk_Structure utility repairs errors that are detected in the file structure of the specified device. Format /[NO]REPAIR /USAGE Specifies that a disk usage accounting file should be produced, in addition to the other specified functions of the Analyze/Disk_ Structure utility. Format /USAGE[=filespec] 2 /ERROR_LOG The Error Log utility (ERROR LOG) selectively reports the contents of an error log file. Format ANALYZE/ERROR_LOG [/qualifier(s)] [file-spec[,...]] 3 Qualifiers /BEFORE /BEFORE[=date-time] Specifies that only those entries dated earlier than the stated date and time are to be selected for the error report. If you do not specify a date or time, all entries are processed. /BINARY /BINARY[=file-spec] /NOBINARY Controls whether the binary error log records are converted to ASCII text or copied to the specified output file. Do not use /BINARY with the /FULL, /BRIEF, /OUTPUT, /REGISTER_ DUMP, or /SUMMARY qualifiers. These qualifiers generate an ASCII report; /BINARY generates a binary file. /BRIEF Generates a brief report. Do not use /BRIEF with the /BINARY qualifier. /ENTRY /ENTRY[=(START:decimal-value[,END:decimal-value])] Generates an error log report that includes the specified entry range or starts at the specified entry number. If you specify /ENTRY without the entry range or omit the qualifier, the entry range defaults to START:1,END:end-of-file. /EXCLUDE /EXCLUDE= { device-class } ( { device-name } [,...]) { entry-type } { } Excludes errors generated by the specified device class, device name, or error log entry type from the error log report. If you specify more than one keyword, you must specify a comma-separated list of values that is enclosed in parentheses. You can specify one or more devices by device class or name. The following keywords and name constructs are valid for specifying devices: Device Class Keywords: ADAPTER BUSES CACHE DISKS INFORMATIONAL LINE_PRINTER REALTIME SYNC_COMMUNICATIONS TAPES VECTOR WORKSTATION Device Name Constructs: DB Group of devices DBA1 Specific device/unit number (DBA1,HSC1$DUA1,DYA0) List of devices (DB,DR,XF) List of device groups You can specify one or more of the following keywords that identify entry types: ATTENTIONS Exclude device attention entries from the report. BUGCHECKS Exclude all types of bugcheck entries from the report. CONFIGURATION Exclude system configuration entries from the report. CONTROL_ENTRIES Exclude control entries from the report. Control entries include the following entry types: o System power failure restarts o Time stamps o System startups o $SNDERR messages (system service to send messages to error log) o Operator messages o Network messages o ERRLOG.SYS created CPU_ENTRIES Exclude CPU-related entries from the report. CPU entries include the following entry types: o SBI alerts/faults o Undefined interrupts o MBA/UBA adapter errors o Asynchronous write errors o UBA errors DEVICE_ERRORS Exclude device error entries from the report. ENVIRONMENTAL_ Exclude environmental entries from the report. ENTRIES MACHINE_CHECKS Exclude machine check entries from the report. MEMORY Exclude memory errors from the report. SNAPSHOT_ENTRIES Exclude snapshot entries from the report. SYNDROME Exclude console-generated entries that describe a symptom set used by Digital Services personnel to identify problems. TIMEOUTS Exclude device timeout entries from the report. UNKNOWN_ENTRIES Exclude any entry that had either an unknown entry type or an unknown device type or class. UNSOLICITED_MSCP Exclude unsolicited MSCP entries from the output report. VOLUME_CHANGES Exclude volume mount and dismount entries from the report. /FULL /FULL (D) /NOFULL Generates a full report which provides all available information for an error log entry. Do not use /FULL with the /BINARY qualifier. /INCLUDE /INCLUDE= { device-class } ( { device-name } [,...]) { entry-type } { } Includes errors generated by the specified device class, device name, or error log entry type in the error log report. If you specify more than one keyword, you must specify a comma-separated list of values that is enclosed in parentheses. You can specify one or more devices by device class or name. The following keywords and name constructs are valid for specifying devices: Device Class Keywords: ADAPTER BUSES CACHE DISKS INFORMATIONAL LINE_PRINTER REALTIME SYNC_COMMUNICATIONS TAPES VECTOR WORKSTATION Device Name Constructs: DB Group of devices DBA1 Specific device/unit number (DBA1,HSC1$DUA1,DYA0) List of devices (DB,DR,XF) List of device groups You can specify one or more of the following keywords that identify entry types: ATTENTIONS Include device attention entries in the report. BUGCHECKS Include all types of bugcheck errors in the report. CONFIGURATION Include system configuration entries in the report. CONTROL_ENTRIES Include control entries in the report. Control entries include the following entry types: o System power failure restarts o Time stamps o System startups o $SNDERR messages (system service to send messages to error log) o Operator messages o Network messages o ERRLOG.SYS created CPU_ENTRIES Include CPU-related entries in the report. CPU entries include the following entry types: o SBI alerts/faults o Undefined interrupts o MBA/UBA adapter errors o Asynchronous write errors o UBA errors DEVICE_ERRORS Include device errors in the report. ENVIRONMENTAL_ Include environmental entries in the report. ENTRIES MACHINE_CHECKS Include machine check errors in the report. MEMORY Include memory errors in the report. SNAPSHOT_ENTRIES Include snapshot entries in the report. SYNDROME Include console-generated entries that describe a symptom set used by Digital Services personnel to identify problems. TIMEOUTS Include device timeout errors in the report. UNKNOWN_ENTRIES Include any entry that had either an unknown entry type or an unknown device type or class. UNSOLICITED_MSCP Include unsolicited MSCP entries in the output report. VOLUME_CHANGES Include volume mount and dismount entries in the report. /LOG /LOG /NOLOG (D) Controls whether informational messages that specify the number of entries selected and rejected for each input file are sent to SYS$OUTPUT. /MODEL /MODEL=(hexadecimal-value[,...]) Generates a report consisting of event log entries that occurred on the specified CPU. If you specify more than one hexadecimal value, you must specify a comma-separated list of values that is enclosed in parentheses. (Alpha only) /NODE /NODE=(node-name[,...]) Generates a report consisting of error log entries for specific nodes in a VMScluster system. If you specify more than one node name, you must specify a comma-separated list of values that is enclosed in parentheses. /OUTPUT /OUTPUT[=file-spec] Specifies the output file for the error log report. If you omit the output file specification, output is directed to SYS$OUTPUT. Do not use /OUTPUT with the /BINARY qualifier. /REGISTER_DUMP Used in conjunction with the /INCLUDE qualifier to generate, in a hexadecimal longword format, a report that consists of device register information. Do not use /REGISTER_DUMP with the /BINARY qualifier. /REJECTED /REJECTED[=file-spec] Allows you to specify the name of a file that will contain binary records for rejected entries. If you do not specify an output file, the data are written to the file ERRLOG.REJ in your current directory. /SID_REGISTER /SID_REGISTER=(hexadecimal-value[,...]) Generates a report consisting of error log entries that occurred on the specified CPU. If you specify more than one hexadecimal value, you must specify a comma-separated list of values that is enclosed in parentheses. (VAX only) /SINCE /SINCE[=date-time] Specifies that only those entries dated later than the stated date and time are to be selected for the report. If you specify /SINCE without a date and time, the default is TODAY. If you omit the /SINCE qualifier, all entries are processed. /STATISTICS Generates run-time statistical information. /SUMMARY /SUMMARY[=(summary-type-keyword[,...])] /NOSUMMARY Generates an error log report that consists of a statistical summary. If you specify more than one keyword, you must specify a comma-separated list of values that is enclosed in parentheses. If you specify /SUMMARY without a summary type, the report contains all of the preceding summary types listed. If you want only a summary report, specify both the /NOFULL and the /SUMMARY qualifiers in the command line. Do not use the /BINARY qualifier with /SUMMARY. (VAX only) 3 Examples 1.$ ANALYZE/ERROR_LOG/BEFORE=19-APR-1994:10:00 ERRLOG.OLD;5 In this example, the error log report generated for ERRLOG.OLD;5 contains entries that were logged before 10:00 a.m on April 19, 1994. 2.$ ANALYZE/ERROR_LOG/INCLUDE=DBA1/BINARY=DBA1_ERR.DAT ERRLOG.OLD;5 In this example, the output file DBA1_ERR.DAT contains image copies of the entries that apply to DBA1. 3.$ ANALYZE/ERROR_LOG/BRIEF ERRLOG.OLD;97 In this example, the error log report generated from ERRLOG.OLD;97 contains minimal information. 4.$ ANALYZE/ERROR_LOG/ENTRY=(START:1,END:18) ERRLOG.SYS In this example, the entry range for the error log report generated from file ERRLOG.SYS is limited to entry numbers 1 through 18. 5.$ ANALYZE/ERROR_LOG/EXCLUDE=MTA0 In this example, the error log entries for the device MTA0 are excluded from the error log report for the file ERRLOG.SYS. 6.$ ANALYZE/ERROR_LOG/EXCLUDE=(MTA0,DRA5) ERRLOG.OLD In this example, the devices MTA0 and DRA5 are excluded from the error log report for the file ERRLOG.OLD. 7.$ ANALYZE/ERROR_LOG/EXCLUDE=TAPES/INCLUDE=MTA0 In this example, the device MTA0 is included in the error log report for the file ERRLOG.SYS. All other magnetic tape devices are excluded from the report. 8.$ ANALYZE/ERROR_LOG/INCLUDE=(DISK,VOLUME_CHANGES,DEVICE_ERROR,BUGCHECK) In this example, the report consists of error log entries for volume and device error information on disks, and bugcheck errors. These entries are in the default error log file ERRLOG.SYS. 9.$ ANALYZE/ERROR_LOG/MODEL=415 ERRLOG.SYS In this example, the output consists of only those entries that were logged for the system with a model type of 00000415 (hexadecimal). 10$ ANALYZE/ERROR_LOG/NODE=(ORANGE,NASSAU) SYS$SYSROOT:[SYS*.SYSERR]ERRLOG.SYS In this example, the VMScluster system consists of members BROOME, NASSAU, ORANGE, and PUTNAM. The output contains only those entries that were logged for nodes NASSAU and ORANGE. 11$ ANALYZE/ERROR_LOG/INCLUDE=DB/REGISTER_DUMP ERRLOG.OLD;72 In this example, the output is in the format of a REGISTER_DUMP report containing entries that apply only to the DB device. 12$ ANALYZE/ERROR_LOG/INCLUDE=MTA0/REJECTED=REAL_ERRS.DAT ERRLOG.OLD;5 In this example, the output file REAL_ERRS.DAT contains image copies of all entries from ERRLOG.OLD;5, with the exception of those entries that apply to the MTA0 device. 13$ ANALYZE/ERROR_LOG/SID_REGISTER=02006148 ERRLOG.OLD;72 The /SID_REGISTER qualifier is for VAX only. In this example, the output consists of only those entries that were logged for the system with an ID of 02006148 (hexadecimal). 14$ ANALYZE/ERROR_LOG/STATISTICS ERRLOG.OLD;4 In this example, the output generated by this command consists of a full report of all entries in ERRLOG.OLD;4 and the run-time statistics for the execution of the command. 15$ ANALYZE/ERROR_LOG/SUMMARY=(ENTRY,DEVICE) The /SUMMARY qualifier is for VAX only. The output generated by the command in this example includes the Entry and Device sections of the summary report from the default input file ERRLOG.SYS. 16$ ANALYZE/ERROR_LOG/INCLUDE=DBA4/NOFULL/SUMMARY ERRLOG.OLD;5 The /SUMMARY qualifier is for VAX only. The output generated by the command in this example includes the summary report. The report contains the entries that apply to the DBA4 device: device error, device timeout, and device attention. 2 /IMAGE Analyzes the contents of an executable image file or a shareable image file on Alpha systems, VAX systems, and translated VAX images and checks for obvious errors in the image file. The /IMAGE qualifier is required. For general information about image files, see the description of the linker in the OpenVMS Linker Utility Manual. (Use the ANALYZE/OBJECT command to analyze the contents of an object file.) Format ANALYZE/IMAGE filespec[,...] 3 Parameter filespec[,...] Specifies the name of one or more image files that you want analyzed. You must specify at least one file name. If you specify more than one file, separate the file specifications with either commas (,) or plus signs (+). The default file type is EXE. Wildcard characters (* and %) are allowed in the file specification. 3 Description The ANALYZE/IMAGE command provides a description of the components of an executable image file or shareable image file. It also verifies that the structure of the major parts of the image file is correct. However, the ANALYZE/IMAGE command cannot ensure that program execution is error free. If errors are found, the first error of the worst severity is returned. For example, if a warning (A) and two errors (B and C) are found, the first error (B) is returned as the image exit status. The image exit status is placed in the DCL symbol $STATUS at image exit. The ANALYZE/IMAGE command distinguishes Alpha system image files from VAX system image files by examining the extended image header (EIHD). The ANALYZE/IMAGE command provides the following information: o Image type-Identifies whether the image is executable or shareable. o Image transfer addresses-Identify the addresses to which control is passed at image execution time. o Image version-Identifies the revision level (major ID and minor ID) of the image. o Location and size of the image's symbol vector (Alpha systems only) o Location of the debugger symbol table (DST)-Identifies the location of the DST in the image file. DST information is present only in executable images that have been linked with the /DEBUG or the /TRACEBACK command qualifier. o Location of the global symbol table (GST)-Identifies the location of the GST in the image file. GST information is present only in shareable image files. o Patch information-Indicates whether the image has been patched (changed without having been recompiled or reassembled and relinked). If a patch is present, the actual patch code can be displayed. o Image section descriptors (ISD)-Identify portions of the image binary contents that are grouped in VMScluster systems according to their attributes. An ISD contains information that the image activator needs when it initializes the address space for an image. For example, an ISD tells whether the ISD is shareable, whether it is readable or writable, whether it is based or position independent, and how much memory should be allocated. o Fixup vectors-Contain information that the image activator needs to ensure the position independence of shareable image references. o System version categories-For an image that is linked against the executive (the system shareable image on Alpha systems or the system symbol table on VAX systems), displays both the values of the system version categories for which the image was linked originally and the values for the system that is currently running. You can use these values to identify changes in the system since the image was linked last. The ANALYZE/IMAGE command has command qualifiers and positional qualifiers. By default, if you do not specify any positional qualifiers (for example, /GST or /HEADER), the entire image is analyzed. If you do specify a positional qualifier, the analysis excludes all other positional qualifiers except the /HEADER qualifier (which is always enabled) and any qualifier that you request explicitly. 3 Qualifiers /FIXUP_SECTION Positional qualifier. Specifies that the analysis should include all information in the fixup section of the image. If you specify the /FIXUP_SECTION qualifier after the ANALYZE /IMAGE command, the fixup section of each image file in the parameter list is analyzed. If you specify the /FIXUP_SECTION qualifier after a file specification, only the information in the fixup section of that image file is analyzed. /GST Positional qualifier. Specifies that the analysis should include all global symbol table records. This qualifier is valid only for shareable images. If you specify the /GST qualifier after the ANALYZE/IMAGE command, the global symbol table records of each image file in the parameter list are analyzed. If you specify the /GST qualifier after a file specification, only the global symbol table records of that file are analyzed. /HEADER Positional qualifier. Specifies that the analysis should include all header items and image section descriptions. The image header items are always analyzed. /INTERACTIVE /INTERACTIVE /NOINTERACTIVE (default) Specifies whether the analysis is interactive. In interactive mode, as each item is analyzed, the results are displayed on the screen and you are asked whether you want to continue. /OUTPUT /OUTPUT=filespec Identifies the output file for storing the results of the image analysis. No wildcard characters are allowed in the file specification. If you specify a file type and omit the file name, the default file name ANALYZE is used. The default file type is ANL. If you omit the qualifier, the results are output to the current SYS$OUTPUT device. /PATCH_TEXT Positional qualifier. Specifies that the analysis include all patch text records. If you specify the /PATCH_TEXT qualifier after the ANALYZE /IMAGE command, the patch text records of each image file in the parameter list are analyzed. If you specify the /PATCH_TEXT qualifier after a file specification, only the patch text records of that file are analyzed. 3 Examples 1.$ ANALYZE/IMAGE LINEDT The ANALYZE/IMAGE command in this example produces a description and an error analysis of the image LINEDT.EXE. Output is sent to the current SYS$OUTPUT device. By default, the entire image is analyzed. 2.$ ANALYZE/IMAGE/OUTPUT=LIALPHEX/FIXUP_SECTION/PATCH_TEXT LINEDT, ALPRIN The ANALYZE/IMAGE command in this example produces a description and an error analysis of the fixup sections and patch text records of LINEDT.EXE and ALPRIN.EXE in file LIALPHEX.ANL. Output is sent to the file LIALPHEX.ANL. 2 /MEDIA Invokes the bad block locator utility (bad), which analyzes block-addressable devices and records the location of blocks that cannot reliably store data. The /MEDIA qualifier is required. for a complete description of BAD, including information about the ANALYZE/MEDIA command and its qualifiers, see the VMS Bad Block Locator Utility Manual. FORMAT: ANALYZE/MEDIA device 3 Parameters device Specifies the device that bad will analyze. The device has the form: ddcu: or logical-name 3 Command_Qualifiers /BAD_BLOCKS /BAD_BLOCKS[=LIST] Adds the specified bad blocks to the detected bad block file (DBBF). If the /BAD_BLOCK qualifier is specified along with the /EXERCISE qualifier, the medium is tested once the bad blocks are added to the DBBF. If you do not specify a value for the /BAD_BLOCK qualifier, you are prompted as follows: BAD_BLOCKS = In prompt mode, BAD reports any duplicate bad blocks. Qualifier Value List Specifies the bad block locations to be added to the DBBF. Valid codes for specifying bad block locations are: Code Meaning LBN Specifies the logical block number (LBN) of a single bad block. LBN:count Specifies a range of contiguous bad blocks starting at the logical block number (LBN) and continuing for "count" blocks. SEC.TRK.CYL Specifies the physical disk address (sector, track, and cylinder) of a single bad sector. This code is valid only for last track devices. SEC.TRK.CYL:count Specifies a range of bad sectors starting at the specified physical disk address (sector, track, and cylinder) and continuing for "count" sectors. This code is valid only for last track devices. You can specify these formats in any integer combination or radix combination. NOTE The term "block" denotes a standard unit of 512 bytes, whereas the term "sector" denotes the physical size of the device sector, which is not always the same for all devices. For example, an rl02 has a sector size of 256 bytes, while an rk07 has a standard sector size of 512 bytes. /EXERCISE /EXERCISE=(FULL,[NO]KEEP,PATTERN) /NOEXERCISE (Default) Controls whether the media should actually be tested. You can update the DBBF without erasing the contents of the volume by using the /NOEXERCISE qualifier along with the /BAD_BLOCKS qualifier. Qualifier Keywords FULL Causes BAD to test the media using three test patterns (0's, 1's, and "worst case") instead of the default single "worst case" pattern. The FULL keyword can be used only with /EXERCISE. Note that the "worst case" test pattern always remains on media tested with the /EXERCISE qualifier. KEEP Ensures the preservation of the current software detected bad block file (SDBBF). The keep keyword is the default when /NOEXERCISE is specified. NOKEEP Causes BAD to create a new SDBBF. The NOKEEP keyword is the default when /EXERCISE is specified. This keyword cannot be used with the /NOEXERCISE qualifier. PATTERN= Allows users to specify the value of a test pattern to be used as "worst case". Up to an octaword of test pattern data may be specified in decimal (%D), hexadecimal (%X), or octal (%O) radixes. The default radix is decimal. The pattern is specified in longwords. If two or more longwords are specified, they must be enclosed in parentheses and separated by commas. /LOG /LOG /NOLOG (Default) Specifies whether a message is sent to the current SYS$OUTPUT device and SYS$ERROR, indicating the total number of bad blocks detected by BAD. /OUTPUT /OUTPUT[=filespec] Specifies whether the contents of the DBBF are written to the specified file. If you omit the /OUTPUT qualifier, no output is generated. If you specify /OUTPUT but omit the filespec, the contents of the DBBF are written to the current SYS$OUTPUT device. When you specify /OUTPUT, the /SHOW=AFTER qualifier is implied. Qualifier Value FILESPEC Identifies the output file for storing the results of the medium analysis. If you specify a file type and omit the file name, the default file name ANALYZE is used. The default file type is ANL. If you omit the filespec, the results are output to the current SYS$OUTPUT device. No wildcard characters are allowed in the file specification. /RETRY /RETRY /NORETRY (Default) Enables the device driver to retry soft errors. /SHOW /SHOW[=(keyword[,...])] Lists the contents of the DBBF before or after (or both) the medium is exercised or modified. Qualifier Keywords [NO]BEFORE,[NO]AFTER Specifies whether the contents of the DBBF are listed before or after (or both) the medium is exercised. After is the default. 3 Examples In examples 1 and 2, the contents of the data region on the medium are not altered or destroyed; in examples 3, 4, and 5, all the data on the medium is destroyed. 1. $ ANALYZE/MEDIA/BAD_BLOCKS=(4.4.4:3) DBA1: The /BAD_BLOCKS qualifier in this example specifies a range of 3 bad blocks beginning at the physical disk address sector 4, track 4, cylinder 4. This range is added to the DBBF. 2. $ ANALYZE/MEDIA /LOG DBB1: DEVICE DBB1: CONTAINS A TOTAL OF 340670 BLOCKS; 11 DEFECTIVE BLOCKS DETECTED. The command in this example requests BAD to report the total number of bad blocks recorded in DBBF's for the disk mounted on DBB1:. The medium is not exercised or altered in any way. 3. $ ANALYZE/MEDIA/EXERCISE/BAD_BLOCKS=(2) DBB1: The command in this example adds the bad block specification to the DBBF and then tests the media. The bad block in this example is located at logical block number (LBN) 2. 4. $ ANALYZE/MEDIA/EXERCISE=KEEP DBA1: This command tests the media while preserving the current SDBBF. 5. $ ANALYZE/MEDIA/EXERCISE/RETRY DBB1: The command in this example directs the device driver to retry soft errors. 2 /OBJECT Analyzes the contents of an object file for Alpha systems, VAX systems and translated VAX images and checks for any obvious errors. The /OBJECT qualifier is required. (Use the ANALYZE/IMAGE command to analyze the contents of an image file.) Format ANALYZE/OBJECT filespec[,...] 3 Parameter filespec[,...] Specifies the object files or object module libraries you want analyzed (the default file type is OBJ). Use commas (,) or plus signs (+) to separate file specifications. Wildcard characters (* and %) are allowed in the file specification. 3 Description The ANALYZE/OBJECT command describes the contents of one or more object modules contained in one or more files. It also performs a partial error analysis. This analysis determines whether all records in an object module conform in content, format, and sequence to the specifications of the Alpha or VAX Object Language. The ANALYZE/OBJECT command automatically distinguishes Alpha objects from VAX objects by examining the format of the extended object modules header (EMH). ANALYZE/OBJECT is intended primarily for programmers of compilers, debuggers, or other software involving the operating system's object modules. It checks that the object language records generated by the object modules are acceptable to the OpenVMS Linker, and it identifies certain errors in the file. It also provides a description of the records in the object file or object module library. For more information on the OpenVMS linker and on object languages, refer to the OpenVMS Linker Utility Manual. The ANALYZE/OBJECT command analyzes the object modules in order, record by record, from the first to the last record in the object module. Fields in each record are analyzed in order from the first to the last field in the record. After the object module is analyzed, you should compare the content and format of each type of record to the required content and format of that record as described by the OpenVMS Alpha or OpenVMS VAX Object Language. This comparison is particularly important if the analysis output contains a diagnostic message. Linking an object module differs from analyzing an object module. Object language commands are not executed in an analysis, but they are executed in a linking operation. As a result, even if the analysis is error free, the linking operation may not be. In particular, the analysis does not check the following: o That data arguments in TIR commands are in the correct format. o That "Store Data" TIR commands are storing within legal address limits. Therefore, as a final check, you should still link an object module whose analysis is error free. If an error is found, however, the first error of the worst severity that is discovered is returned. For example, if a warning (A) and two errors (B and C) are signaled, then the first error (B) is returned as the image exit status, which is placed in the DCL symbol $STATUS at image exit. ANALYZE/OBJECT uses positional qualifiers; that is, qualifiers whose function depends on their position in the command line. When a positional qualifier precedes all of the input files in a command line, it affects all input files. For example, the following command line requests that the analysis include the global symbol directory records in files A, B, and C: $ ANALYZE/OBJECT/GSD A,B,C Conversely, when a positional qualifier is associated with only one file in the parameter list, only that file is affected. For example, the following command line requests that the analysis include the global symbol directory records in file B only: $ ANALYZE/OBJECT A,B/GSD,C Typically, all records in an object module are analyzed. However, when the /DBG, /EOM, /GSD, /LNK, /MHD, /TBT, or /TIR qualifier is specified, only the record types indicated by the qualifiers are analyzed. All other record types are ignored. By default, the analysis includes all record types unless you explicitly request a limited analysis using appropriate qualifiers. NOTE End-of-module (EOM) records and module header (MHD) records are always analyzed, no matter which qualifiers you specify. 3 Qualifiers /DBG /DBG Positional qualifier. Specifies that the analysis should include all debugger information records. If you want the analysis to include debugger information for all files in the parameter list, insert the /DBG qualifier immediately following the /OBJECT qualifier. If you want the analysis to include debugger information selectively, insert the /DBG qualifier immediately following each of the selected file specifications. /EOM /EOM Positional qualifier. Specifies that the analysis should be limited to MHD records, EOM records, and records explicitly specified by the command. If you want this to apply to all files in the parameter list, insert the /EOM qualifier immediately following the /OBJECT qualifier. To make the /EOM qualifier applicable selectively, insert it immediately following each of the selected file specifications. NOTE End-of-module records can be EOM or EOMW records. See the OpenVMS Linker Utility Manual for more information. /GSD /GSD Positional qualifier. Specifies that the analysis should include all global symbol directory (GSD) records. If you want the analysis to include GSD records for each file in the parameter list, specify the /GSD qualifier immediately following the /OBJECT qualifier. If you want the analysis to include GSD records selectively, insert the /GSD qualifier immediately following each of the selected file specifications. /INCLUDE /INCLUDE[=(module[,...])] When the specified file is an object module library, use this qualifier to list selected object modules within the library for analysis. If you omit the list or specify an asterisk (*), all modules are analyzed. If you specify only one module, you can omit the parentheses. /INTERACTIVE /INTERACTIVE /NOINTERACTIVE (default) Controls whether the analysis occurs interactively. In interactive mode, as each record is analyzed, the results are displayed on the screen, and you are asked whether you want to continue. /LNK /LNK Positional qualifier. Specifies that the analysis should include all link option specification (LNK) records. If you want the analysis to include LNK records for each file in the parameter list, specify the /LNK qualifier immediately following the /OBJECT qualifier. If you want the analysis to include LNK records selectively, insert the /LNK qualifier immediately following each of the selected file specifications. /MHD /MHD Positional qualifier. Specifies that the analysis should be limited to MHD records, EOM records, and records explicitly specified by the command. If you want this analysis to apply to all files in the parameter list, insert the /MHD qualifier immediately following the /OBJECT qualifier. To make the /MHD qualifier applicable selectively, insert immediately following each of the selected file specifications. /OUTPUT /OUTPUT[=filespec] Directs the output of the object analysis (the default is SYS$OUTPUT). If you specify a file type and omit the file name, the default file name ANALYZE is used. The default file type is ANL. No wildcard characters are allowed in the file specification. /TBT /TBT Positional qualifier. Specifies that the analysis should include all module traceback (TBT) records. If you want the analysis to include TBT records for each file in the parameter list, specify the /TBT qualifier immediately following the /OBJECT qualifier. If you want the analysis to include TBT records selectively, insert the /TBT qualifier immediately following each of the selected file specifications. /TIR /TIR Positional qualifier. Specifies that the analysis should include all text information and relocation (TIR) records. If you want the analysis to include TIR records for each file in the parameter list, specify the /TIR qualifier immediately following the /OBJECT qualifier. If you want the analysis to include TIR records selectively, insert the /TIR qualifier immediately following the selected file specifications. 3 Examples 1.$ ANALYZE/OBJECT/INTERACTIVE LINEDT In this example, the ANALYZE/OBJECT command produces a description and a partial error analysis of the object file LINEDT.OBJ. By default, all types of records are analyzed. Output is to the terminal, because the /INTERACTIVE qualifier has been used. As each item is analyzed, the utility displays the results on the screen and asks if you want to continue. 2.$ ANALYZE/OBJECT/OUTPUT=LIOBJ/DBG LINEDT In this example, the ANALYZE/OBJECT command analyzes only the debugger information records of the file LINEDT.OBJ. Output is to the file LIOBJ.ANL. 2 /PROCESS_DUMP Invokes the debugger to analyze a process dump file that was created when an image failed during execution. (Use the /DUMP qualifier with the RUN or the SET PROCESS command to generate a dump file.) The ANALYZE PROCESS_DUMP command can display a process dump file for an image. For a complete description of the debugger (including information about the DEBUG command), see the OpenVMS Debugger Manual. Requires read (R) access to the dump file. Format ANALYZE/PROCESS_DUMP dump-file 3 Parameter dump-file Specifies the dump file to be analyzed with the debugger. 3 Qualifiers /FULL Displays all known information about the failing process. /IMAGE /IMAGE=image-name /NOIMAGE Specifies the image whose symbols are to be used in analyzing the dump. If you use the /NOIMAGE qualifier, no symbols are taken from any image. By default, symbols are taken from the image with the same name as the image that was running at the time of the dump. /INTERACTIVE /INTERACTIVE /NOINTERACTIVE (default) Causes the display of information to pause when your terminal screen is filled. Press the Return key to display additional information. By default, the display is continuous. /MISCELLANEOUS Displays process information and registers at the time of the dump. Refer to the $GETJPI system service for further explanation of the process information displayed. /OUTPUT /OUTPUT=filespec Writes the information to the specified file. By default, the information is written to the current SYS$OUTPUT device. The asterisk (*) and the percent sign (%) wildcard characters are not allowed in the file specification. /RELOCATION Displays the addresses to which data structures saved in the dump are mapped in P0 space. (Examples of such data structures are the stacks.) The data structures in the dump must be mapped into P0 space so that the debugger can use those data structures in P1 space. 3 Examples 1.$ ANALYZE/PROCESS/FULL ZIPLIST R0 = 00018292 R1 = 8013DE20 R2 = 7FFE6A40 R3 = 7FFE6A98 R4 = 8013DE20 R5 = 00000000 R6 = 7FFE7B9A R7 = 0000F000 R8 = 00000000 R9 = 00000000 R10 = 00000000 R11 = 00000000 SP = 7FFAEF44 AP = 7FFAEF48 FP = 7FFAEF84 FREE_P0_VA 00001600 FREE_P1_VA 7FFAC600 Active ASTs 00 Enabled ASTs 0F Current Privileges FFFFFF80 1010C100 Event Flags 00000000 E0000000 Buffered I/O count/limit 6/6 Direct I/O count/limit 6/6 File count/limit 27/30 Process count/limit 0/0 Timer queue count/limit 10/10 AST count/limit 6/6 Enqueue count/limit 30/30 Buffered I/O total 7 Direct I/O total 18 Link Date 27-DEC-1994 15:02:00.48 Patch Date 17-NOV-1994 00:01:53.71 ECO Level 0030008C 00540040 00000000 34303230 Kernel stack 00000000 pages at 00000000 moved to 00000000 Exec stack 00000000 pages at 00000000 moved to 00000000 Vector page 00000001 page at 7FFEFE00 moved to 00001600 PIO (RMS) area 00000005 pages at 7FFE1200 moved to 00001800 Image activator context 00000001 page at 7FFE3400 moved to 00002200 User writable context 0000000A pages at 7FFE1C00 moved to 00002400 Creating a subprocess VAX DEBUG Version 5.4 DBG> On VAX, this example shows the output of the ANALYZE/PROCESS command when used with the /FULL qualifier on a VAX system. The file specified, ZIPLIST, contains the dump of a process that encountered a fatal error. The DBG> prompt indicates that the debugger is ready to accept commands. 2.$ ANALYZE/PROCESS/FULL ARITH.DMP R0 = 000000000000000F R1 = 0000000000000001 R2 = 0000000000010000 R3 = 000000007FF41E14 R4 = 000000007FFBF80C R5 = 000000007FFBF91C R6 = 000000007FFA0D34 R7 = 000000007FFA0D34 R8 = 000000007FFA05F8 R9 = 000000007FFA0800 R10 = 000000007FFA1380 R11 = 000000007FFBE3E0 R12 = 0000000000000004 R13 = FFFFFFFF84EF3730 R14 = 0000000000000000 R15 = 0000000000000000 R16 = 00000000002D4EC8 R17 = 0000000100000000 R18 = 00000000002D4EAE R19 = 0000000000000000 R20 = 0000000000000000 R21 = 0000000000000000 R22 = 002D559100000000 R23 = 00000000002D5591 R24 = 002D559100000000 R25 = 0000000000000003 R26 = 0000000000020040 R27 = 0000000000032AA0 R28 = 0000000000052DA0 AP = 000000007FE6F6F0 FP = 000000007FE6FA20 SP = 000000007FE6FA20 PC = 0000000000020048 FREE_P0_VA 002F6000 FREE_P1_VA 7FE68000 Active ASTs 00 Enabled ASTs 0F Current Privileges 00000000 00108000 Event Flags 00000000 E0000000 Buffered I/O count/limit 100/100 Direct I/O count/limit 100/100 File count/limit 98/100 Process count/limit 0/0 Timer queue count/limit 10/10 AST count/limit 98/100 Enqueue count/limit 600/600 Buffered I/O total 118 Direct I/O total 37 Link Date 14-DEC-1994 13:06:06.72 Kernel stack 00000000 pagelets at 00000000 moved to 00000000 Exec stack 00000000 pagelets at 00000000 moved to 00000000 Vector page 00000002 pagelet at 7FFF0000 moved to 002F6000 PIO (RMS) area 00000000 pagelets at 00000000 moved to 00000000 Image activator context 00000001 pagelet at 7FFD0E00 moved to 002F8000 User writeable context 00000008 pagelets at 7FFC0000 moved to 002FA000 Condition signalled to take dump: %SYSTEM-F-HPARITH, high performance arithmetic trap, Imask=00000000, -Fmask=00000001, summary=04, PC=00020048, PS=0000001B -SYSTEM-F-FLTDIV, arithmetic trap, floating/decimal divide by zero -at PC=00020048, PS=0000001B OpenVMS Alpha DEBUG Version 1.0 %DEBUG-I-NOLOCALS, image does not contain local symbols %DEBUG-I-NOGLOBALS, some or all global symbols not accessible %DEBUG-I-NOUNIVERSALS, shareable image contains no universal symbols %DEBUG-I-INITIAL, language is UNKNOWN, module set to SHARE$ARITH DBG> On Alpha, this example shows the output of the ANALYZE/PROCESS command when used with the /FULL qualifier on an Alpha system. 3.$ INSTALL INSTALL> ADD SYS$LIBRARY:DELTA INSTALL> EXIT $ DEFINE LIB$DEBUG DELTA $ ANALYZE/PROCESS/FULL PCFS_SERVER.DMP R0 = 004558452E524556 R1 = 00000000004F1080 R2 = 000000000000048C R3 = 0000000000000000 R4 = 0000000000000000 R5 = 0000000000000001 R6 = 0000000000F380C0 R7 = 00000000000000E9 R8 = 00000000002D3F70 R9 = 0000000000342FB8 R10 = 00000000002CE330 R11 = 0000000000000047 R12 = 00000000005107C0 R13 = 0000000000F38140 R14 = 0000000000D5D5C8 R15 = 00000000000000F0 R16 = 000000000003793C R17 = 00000000004F108C R18 = 0000000000000000 R19 = 00000000004F1C00 R20 = 00000000004F1C00 R21 = FFFFFFFF8052C4B6 R22 = 0000000000000001 R23 = FFFFFFFF80042E90 R24 = 0000000000000001 R25 = 0000000000000000 R26 = 0000000000002000 R27 = 00000000000184A0 R28 = 0000000000000001 AP = 0000000000F37E10 FP = 0000000000DE0ED8 SP = 0000000000F38110 PC = 0000000000002000 FREE_P0_VA 00F50000 FREE_P1_VA 7FE6A000 Active ASTs 00 Enabled ASTs 0F Current Privileges FFFFFFFF FFF7FFFF Event Flags 80000000 E0000000 Buffered I/O count/limit 32758/32767 Direct I/O count/limit 32767/32767 File count/limit 32720/32767 Process count/limit 0/0 Timer queue count/limit 32763/32767 AST count/limit 32754/32767 Enqueue count/limit 32760/32767 Buffered I/O total 17353137 Direct I/O total 333631 Link Date 8-SEP-1992 16:42:37.94 Kernel stack 00000020 pagelets at 7FF92000 moved to 00F50000 Exec stack 00000020 pagelets at 7FF96000 moved to 00F54000 Vector page 00000002 pagelet at 7FFF0000 moved to 00F58000 PIO (RMS) area 00000007 pagelets at 7FFD0000 moved to 00F5A000 Image activator context 00000001 pagelet at 7FFD0E00 moved to 00F5C000 User writeable context 00000008 pagelets at 7FFC0000 moved to 00F5E000 Condition signalled to take dump: %SYSTEM-F-ACCVIO, access violation, reason mask=00, virtual address=00002000, PC=00002000, PS=0000001B AlphaVMS DELTA Version 1.5 Exception - Signal reason = 0000000C 00002000! On Alpha, in this example, the SYS$LIBRARY:DELTA image is installed on an Alpha system by invoking the Install utility. Next, the logical LIB$DEBUG is defined as DELTA in order to use the Delta Debugger (DELTA). The ANALYZE/PROCESS_DUMP command displays exception information and then a prompt. You can analyze the stack or other information provided to you in the dump. 2 /RMS_FILE Invokes the OpenVMS Analyze/RMS_File utility to inspect and analyze the internal structure of an OpenVMS RMS file. The /RMS_ FILE qualifier is required. For a complete description of the Analyze/RMS_File utility, including more information about the ANALYZE/RMS_FILE command and its qualifiers, see the OpenVMS Record Management Utilities Reference Manual. ANALYZE/RMS_FILE filespec[,...] 3 Parameter filespec[,...] Specifies the data file to be analyzed. The default file type is .DAT. You can use multiple file specifications and wildcard characters with the /CHECK qualifier, the /RU_JOURNAL qualifier, the /STATISTICS qualifier, and the /SUMMARY qualifier, but not with the /FDL qualifier or the /INTERACTIVE qualifier. 3 Qualifiers /CHECK Checks the integrity of the file and generates a report of any errors in its structure. The report produced by the /CHECK qualifier includes a list of any errors and a summary of the file's structure. If you do not specify an output file, the report is written to the current SYS$OUTPUT device, which is generally your terminal. You can use wildcards and multiple file specifications. If you specify /NOOUTPUT, you only get a message indicating whether the file has errors. The check function is active by default when you use the ANALYZE /RMS_FILE command without any qualifiers. The /CHECK qualifier is not compatible with the /FDL qualifier, the /INTERACTIVE qualifier, the /STATISTICS qualifier, or the /SUMMARY qualifier. /FDL Generates an FDL file describing the OpenVMS RMS data file being analyzed. By default, the /FDL qualifier creates a file with the file type .FDL and the same file name as the input data file. To assign a different type or name to the FDL file, use the /OUTPUT qualifier. If the data file is corrupted, the FDL file contains the Analyze/RMS_File utility error messages. For indexed files, the FDL file contains special analysis sections you can use with the EDIT/FDL Optimize script to make better design decisions when you reorganize the file. You cannot use wildcards or multiple file specifications with the /FDL qualifier. The /FDL qualifier is not compatible with the /CHECK qualifier, the /INTERACTIVE qualifier, the /STATISTICS qualifier, or the /SUMMARY qualifier. /INTERACTIVE Begins an interactive examination of the file's structure. You cannot use wildcards or multiple file specifications. For help with the interactive commands, type HELP at the ANALYZE> prompt. Do not use this qualifier with /CHECK, /FDL, /STATISTICS, or /SUMMARY. /OUTPUT /OUTPUT=filesspec /NOOUTPUT Identifies the destination file for the results of the analysis. The /NOOUTPUT qualifier specifies that no output file is to be created. In all cases, the Analyze/RMS_File utility displays a message indicating whether the data file has errors. /CHECK Places the integrity report in the output file. The default file type is .ANL, and the default file name is ANALYZE. If you omit the output- filespec parameter, output is written to the current SYS$OUTPUT device, which is generally your terminal. /FDL Places the resulting FDL specification in the output file. The default file type is .FDL, and the default file name is that of the input file. /INTERACTIVE Places a transcript of the interactive session in the output file. The default file type is .ANL, and the default file name is ANALYZE. If you omit the output-filespec parameter, no transcript of your interactive session is produced. /RU_JOURNAL Places the recovery-unit journal information in the output file. The default file type is .ANL, and the default file name is ANALYZE. If you omit the output-filespec parameter, output is written to the current SYS$OUTPUT device, which is generally your terminal. /STATISTICS Places the statistics report in the output file. The default file type is .ANL, and the default file name is ANALYZE. If you omit the output- filespec parameter, output is written to the current SYS$OUTPUT device, which is generally your terminal. /SUMMARY Places the summary report in the output file. The default file type is .ANL, and the default file name is ANALYZE. If you omit the output- filespec parameter, output is written to the current SYS$OUTPUT device, which is generally your terminal. /RU_JOURNAL Provides information about recovery-unit journaling where applicable. You can use the /RU_JOURNAL qualifier on any file, but it is inoperative on files not marked for recovery-unit journaling. This qualifier provides the only way of accessing a file that would otherwise be inaccessible because of unresolved recovery units. This situation might be the result of an unavailable recovery-unit journal file or of unavailable data files that were included in the recovery unit. To use the /RU_JOURNAL qualifier, your process must have both CMEXEC privilege and access to the [SYSJNL] directory (either SYSPRV privilege or access for UIC [1,4]). This qualifier is compatible with all of the ANALYZE/RMS_FILE qualifiers, and you can use it with wildcards and multiple file specifications. When you specify the /RU_JOURNAL qualifier, the Analyze/RMS_File utility provides you with the following data for each active recovery unit: o The journal file specification and the journal creation date o The recovery-unit identification, recovery-unit start time, cluster system identification number (CSID), and process identification (PID) o Information about the files involved in the recovery unit, including the file specification, the name of the volume where the file resides, the file identification, the date and time the file was created, and the current status of the file o The state of the recovery unit - active, none, started, committed, or not available (for more information, see the OpenVMS RMS Journaling Manual) o An error statement /STATISTICS Specifies that a report is to be produced containing statistics about the file. The /STATISTICS qualifier is used mainly on indexed files. By default, if you do not specify an output file with the /OUTPUT qualifier, the statistics report is written to the current SYS$OUTPUT device, which is generally your terminal. The /STATISTICS qualifier is not compatible with the /CHECK qualifier, the /FDL qualifier, the /INTERACTIVE qualifier, or the /SUMMARY qualifier. /SUMMARY Specifies that a summary report is to be produced containing information about the file's structure and use. The /SUMMARY qualifier generates a summary report containing information about the file's structure and use. If the file has no errors, the output generated from the /SUMMARY qualifier is identical to that produced by the /CHECK qualifier. Unlike the /CHECK qualifier, however, the /SUMMARY qualifier does not check the structure of your file, so output is generated more quickly. Do not use this qualifier with the /CHECK qualifier, the /FDL qualifier, the /INTERACTIVE qualifier, or the /STATISTICS qualifier. 3 EXAMPLES $ ANALYZE/RMS_FILE/CHECK CUSTFILE This command checks the file CUSTFILE.DAT for errors and displays the report on the terminal. $ ANALYZE/RMS_FILE/FDL ADDRFILE This command generates an FDL file named ADDRFILE.FDL from the data file ADDRFILE.DAT. $ ANALYZE/RMS_FILE DENVER::DB1:[PROD]RUN.DAT This command analyzes the structure of the file RUN.DAT residing at remote node DENVER. 2 /SYSTEM Invokes the System Dump Analyzer (SDA) utility to analyze a running system. You cannot specify the /CRASH_DUMP or /RELEASE qualifier when you use the /SYSTEM qualifier with the ANALYZE command. For a complete description of SDA, including more information about the ANALYZE/SYSTEM command and its qualifiers, see the OpenVMS VAX System Dump Analyzer Utility Manual. Caution ------- Although the analysis of a running system might be instructive, be aware that system context, process context, and a processor's hardware context remain fluid during any given display. In a multiprocessing environment, a process running SDA might be rescheduled to a different processor frequently during analysis. Therefore, Digital recommends that you not examine the hardware Also, when using SDA to analyze a running system, use caution in interpreting its displays. Because system states change frequently, it is possible that the information SDA displays might be inconsistent with the actual, volatile state of the system at any given moment. Format ANALYZE/SYSTEM 3 Example $ ANALYZE/SYSTEM This command invokes SDA to analyze the running system.