Sponsored Content
Full Discussion: Solaris BSM log software
Operating Systems Solaris Solaris BSM log software Post 302108165 by yoder on Friday 23rd of February 2007 11:31:25 AM
Old 02-23-2007
audit_syslog

Is there an audit_syslog plugin or third party app for sol 9?
 

9 More Discussions You Might Find Interesting

1. Programming

how to write to Solaris BSM log

I have a C program and want to write messages to a log. BSM is being used for O/S auditing. Can I write my messages to the BSM log? If so, how do I do that? I'm not finding any API's for that. Any URLs, samples, guidance would be appreciated. (0 Replies)
Discussion started by: JDO
0 Replies

2. UNIX for Dummies Questions & Answers

solaris BSM and Auditing

Hi Guys, I am new to this forum so I am sorry if i posted this thread in the wrong place. I am currently trying to get BSM to work on solaris 10 by Logging few things for me. I need your help to complete this task please. this is the config of the audit files: audit_conto # Copyright... (18 Replies)
Discussion started by: skywalker850i
18 Replies

3. Solaris

Solaris BSM audit log

I got a lot of this message in my /var/audit log how can I exclude this message? header,127,2,invalid event number,fe,hostsol1.com.sg,2007-12-21 00:10:01.001 +08:00,argument,1,0x5,processor ID,argument ,2,0x3,flag,text,P_STATUS,subject,zhang1,root,root,root,root,18228,576129155,291 131094... (1 Reply)
Discussion started by: geoffry
1 Replies

4. Cybersecurity

audit user in BSM/C2 Log

Hi, I keep encountering events in the BSM/C2 logs which shows that the audit-user who performed the event is the user (e.g. ongkk in the example below). However, the user is able to show me that he wasn't logged in at that time nor have the rights to perform the event (e.g. su in this example).... (5 Replies)
Discussion started by: BERNIELEE68
5 Replies

5. Solaris

Solaris Software

Does anyone know of any other place to download Solaris 9 packages other than Oracle's website. I'm looking to setup Solaris 9 containers and needing package SUNWs9brandk. I don't have a account with Oracle to allow me to download this package. I'm using a Solaris 10 server update 9. (1 Reply)
Discussion started by: soupbone38
1 Replies

6. Solaris

BSM auditing

Hi , I don't want logs from a particular "library" to get recorded in the audit.log file. Is that possible with BSM? Please guide. Thanks. (2 Replies)
Discussion started by: chinchao
2 Replies

7. Solaris

Needs some orientation on BSM/auditing

New to Solaris in general (coming from a RHEL background) I'm trying to enable auditing on the system with the following in /etc/security/audit_control: But there are two areas where it seems to break with expected behavior (maybe it's poor expectations on my part): 1) it seems to be... (0 Replies)
Discussion started by: thmnetwork
0 Replies

8. Solaris

BSM not catching creat64

Solaris 9 system: I'm trying to get BSM to record to the point where additional files being put into /etc/opt/csw/sudoers.d will be recorded but thus far all I'm able to get are when files are deleted (via unlink). I've even tried auditing based on the "all" audit flag temporarily (thinking I... (2 Replies)
Discussion started by: thmnetwork
2 Replies

9. Solaris

How can I read Solaris BSM log?

Hi all, I'm trying to read Solaris BSM log in user friendly form. Found old tools including bsmparser java tool and php code. But none of them working. What are you using for parsing BSM log? (2 Replies)
Discussion started by: sembii
2 Replies
audit_syslog(5) 					Standards, Environments, and Macros					   audit_syslog(5)

NAME
audit_syslog - realtime conversion of Solaris audit data to syslog messages SYNOPSIS
/usr/lib/security/audit_syslog.so DESCRIPTION
The audit_syslog plugin module for Solaris audit, /usr/lib/security/audit_syslog.so, provides realtime conversion of Solaris audit data to syslog-formatted (text) data and sends it to a syslog daemon as configured in syslog.conf(4). The plugin's path is specified in the audit configuration file, audit_control(4). Messages to syslog are written if selected via the plugin option in audit_control. Syslog messages are generated with the facility code of LOG_AUDIT (audit in syslog.conf(4)) and severity of LOG_NOTICE. Audit syslog messages contain data selected from the tokens described for the binary audit log. (See audit.log(4)). As with all syslog messages, each line in a syslog file consists of two parts, a syslog header and a message. The syslog header contains the date and time the message was generated, the host name from which it was sent, auditd to indicate that it was generated by the audit daemon, an ID field used internally by syslogd, and audit.notice indicating the syslog facility and severity values. The syslog header ends with the characters "] ", that is, a closing square bracket and a space. The message part starts with the event type from the header token. All subsequent data appears only if contained in the original audit record and there is room in the 1024-byte maximum length syslog line. In the following example, the backslash () indicates a continuation; actual syslog messages are contained on one line: Oct 31 11:38:08 smothers auditd: [ID 917521 audit.notice] chdir(2) ok session 401 by joeuser as root:other from myultra obj /export/home In the preceding example, chdir(2) is the event type. Following this field is additional data, described below. This data is omitted if it is not contained in the source audit record. ok or failed Comes from the return or exit token. session <#> <#> is the session ID from the subject token. by <name> <name> is the audit ID from the subject token. as <name>:<group> <name> is the effective user ID and <group> is the effective group ID from the subject token. in <zone name> The zone name. This field is generated only if the zonename audit policy is set. from <terminal> <terminal> is the text machine address from the subject token. obj <path> <path> is the path from the path token The path can be truncated from the left if necessary to fit it on the line. Truncation is indi- cated by leading ellipsis (...). proc_uid <owner> <owner> is the effective user ID of the process owner. proc_auid <owner> <owner> is the audit ID of the process owner. The following are example syslog messages: Nov 4 8:27:07 smothers auditd: [ID 175219 audit.notice] system booted Nov 4 9:28:17 smothers auditd: [ID 752191 audit.notice] login - rlogin ok session 401 by joeuser as joeuser:staff from myultra Nov 4 10:29:27 smothers auditd: [ID 521917 audit.notice] access(2) ok session 255 by janeuser as janeuser:staff from 129.146.89.30 obj /etc/passwd OBJECT ATTRIBUTES
The p_flag attribute, specified by means of the plugin directive (see audit_control(4)), is used to further filter audit data being sent to the syslog daemon beyond the classes specified through the flags and naflags lines of audit_control and through the user-specific lines of audit_user(4). The parameter is a comma-separated list; each item represents an audit class (see audit_class(4)) and is specified using the same syntax used in audit_control for the flags and naflags lines. The default (no p_flags listed) is that no audit records will be gener- ated. EXAMPLES
Example 1: One Use of the plugin Line In the specification shown below, the plugin line (in conjunction with flags and naflags) is used to allow class records for lo but allows class records for am for failures only. Omission of the fm class records results in no fm class records being output. The pc parameter has no effect because you cannot add classes to those defined by means of flags and naflags and by audit_user(4). You can only remove them. flags: lo,am,fm naflags: lo plugin: name=audit_syslog.so; p_flags=lo,-am Example 2: Use of all In the specification shown below, with one exception, all allows all flags defined by means of flags and naflags (and audit_user(4)). The exception the am metaclass, which is equivalent to ss,as,ua, which is modified to output all ua events but only failure events for ss and as. flags: lo,am naflags: lo plugin: name=audit_syslog.so; p_flags=all,^+ss,^+as ATTRIBUTES
See attributes(5) for a description of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | +-----------------------------+-----------------------------+ |MT Level |MT-Safe | +-----------------------------+-----------------------------+ |Interface Stability |: | +-----------------------------+-----------------------------+ | message format |Unstable | +-----------------------------+-----------------------------+ | message content |Unstable | +-----------------------------+-----------------------------+ | config parameters |Evolving | +-----------------------------+-----------------------------+ SEE ALSO
auditd(1M), audit_class(4), audit_control(4), syslog.conf(4), attributes(5) NOTES
Use of the plugin configuration line to include audit_syslog.so requires that /etc/syslog.conf is configured to store syslog messages of facility audit and severity notice or above in a file intended for Solaris audit records. An example of such a line in syslog.conf is: audit.notice /var/audit/audit.log Messages from syslog are sent to remote syslog servers by means of UDP, which does not guarantee delivery or ensure the correct order of arrival of messages. If the parameters specified for the plugin line result in no classes being preselected, an error is reported by means of a syslog alert with the LOG_DAEMON facility code. The time field in the syslog header is generated by syslog(3C) and only approximates the time given in the binary audit log. Normally the time field shows the same whole second or at most a few seconds' difference. SunOS 5.10 26 Aug 2004 audit_syslog(5)
All times are GMT -4. The time now is 05:09 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy