Initiation and termination
On VAX systems running
DECnet for OpenVMS, each network connection results in four audits:
The source node, which
initiates the connection, logs the first event message.
The target node, which
receives the incoming initiation message, logs the second event.
The third event message
is logged by whichever node terminates the connection.
The last event message
is logged by the node where the link is terminated.
With an incoming network connection, the auditing
message has a remote user name field that identifies who initiated
the connection. With outgoing logical link connections, the remote
logical link identifier is always 0.