Relay-Version: version B 2.10 5/3/83; site utzoo.UUCP
Path: utzoo!mnetor!seismo!think!nike!ucbcad!ucbvax!HGRRUG51.BITNET!KROON
From: KROON@HGRRUG51.BITNET (Peter A. Kroon, KVI, +31-50-633618)
Newsgroups: mod.computers.vax
Subject: Undocumented VMS command SET WATCH FILE /CLASS=...
Message-ID: <8609060407.AA27210@ucbvax.Berkeley.EDU>
Date: Fri, 5-Sep-86 15:06:00 EDT
Article-I.D.: ucbvax.8609060407.AA27210
Posted: Fri Sep  5 15:06:00 1986
Date-Received: Sat, 6-Sep-86 05:37:19 EDT
Sender: daemon@ucbvax.BERKELEY.EDU
Organization: The ARPA Internet
Lines: 28
Approved: info-vax@sri-kl.arpa

After some experimenting I found the following:
The VMS command SET WATCH seems to be a command that allows you to monitor
all XQP activity of your process. Its syntax is as follows:

    $ SET WATCH option /CLASS = [NO]ALL
                                NONE
                                [NO]ATTRIBUTES
                                [NO]CONTROL_FUNCTIONS
                                [NO]DIRECTORY_OPERATIONS
                                [NO]DUMP
                                [NO]ATTACHED
                                [NO]MAJOR_FUNCTIONS
                                [NO]QUOTA_OPERATIONS


where (currently?) the only option is the keyword FILE.
I don't understand the command in all its glory but I found some of the
classes very useful if I want to get some insight in:

o Why is a program using so damned much         (/CLASS=QUOTA_OPERATIONS)
  disquota?

o How is this program fiddling around with
  my system's files? (e.g. trojan horses)       (/CLASS=MAJOR_FUNCTIONS)

Good luck, and let me know if you find other nice applications.

Peter A. Kroon, K.V.I. Groningen, Netherlands. KROON@HGRRUG51.BITNET