Cybersecurity

Hi all

I'm busy testing auditing on Solaris 10.

I am using the syslog plugin to get real time view of what's happening on the system. Initially I am only monitoring lo events. The audit_control file looked like this:

Code:

dir:/var/audit
flags:lo
minfree:20
naflags:lo
plugin:name=audit_syslog.so;p_flags=lo

I then wanted to add the the class, fd, as well. I did this as follows:

Code:

dir:/var/audit
flags:lo,fd
minfree:20
naflags:lo
plugin:name=audit_syslog.so;p_flags=lo,fd

I ran the command to reread the audit_control file:

Code:

audit -s

Also just, in case, I restarted the box using

Code:

init 6

I am however not seeing file delete events being tracked when I test it.

Is there something I am doing wrong? The documentation I have found is not helping me much in this regard.

Whilst I do use Solaris auditing on all my boxes, I don't currently have access to my test system to try out the syslog plugin. A few thoughts:

1. Are you seeing the lo events in the syslog feed?
2. Are you able to see the fd events if you configure audit to write them to file?
3. All the documentation* examples for the syslog plugin show p_flags entries as preceeded by either a "+" or "-" - perhaps try adding these?

(SAG: Security Services, #816-4557-19, Sep 2010)