Solaris

Hello,
I've installed solaris audit on a Solaris 10 SPARC system.
Latest patch 143962-04 is installed.
My problem is that while I can catch all arguments and processes created, I cannot catch a redirection. ie

Code:

cat /tmp/test.txt > /tmp/test2.txt

Catches the first part but not the redirection.
Can somebody tell if it is a limitation of the system, or I'm just missing something?

Thank you

Redirections are done by the shell before the command is exec'ed. So tracing exec operations won't see redirections.

So... no ideas on how to catch them?

Solaris audit is growing veeeery tiresome...

You don't "catch" as much as "replace".

Code:

exec >stdout-output
exec 2>stderr-output
exec <stdin-input

Of course, being unable to use their output or feed a script any input makes it very annoying to use...

If you audit file creation, you will have events from specified user.

Around the same timestamp it would generate file creation and executed command with parameters passed (other class).

I haven't tested this of course but i figure it is like that.

Question is what is the actual requirement of audit, what information on what incident do you need ?
Try talking to the folks to refine/define the requirements of audit, be more specific etc.

Hope that helps
Regards
Peasant.

Redirection is just another form of file creation/truncation/read/write.

How is that any different from starting an editor and opening the file from within the editor? You don't see that on any command line either.

If you're already auditing file creation/truncation/read/write, it really doesn't matter HOW the user did something. And if you're not already auditing those, you're wasting your time with auditing.