How can i enable audit logs for global zone and standard zones?


 
Thread Tools Search this Thread
Operating Systems Solaris How can i enable audit logs for global zone and standard zones?
# 8  
Old 12-29-2015
Hi Sorry for the late replay.

while trying to issue above command, i m getting below errors and my service is in maintenance mode

Code:
bash-3.2# audit -s
audit: Cannot read audit policy:  Invalid argument
bash-3.2# auditconfig -getpolicy
auditconfig: auditon(2) failed.
auditconfig: error = Invalid argument(22)
bash-3.2# auditconfig -getqctrl
auditconfig: auditon(2) failed.
auditconfig: error = Invalid argument(22)
bash-3.2# auditconfig -getplugin
usage: auditconfig option ...
 -aconf
 -audit event sorf retval string
 -chkaconf
 -chkconf
 -conf
 -getasid
 -getaudit
 -getauid
 -getcar
 -getclass event
 -getcond
 -getcwd
 -getestate event
 -getfsize
 -getkaudit
 -getkmask
 -getpinfo pid
 -getpolicy
 -getqbufsz
 -getqctrl
 -getqdelay
 -getqhiwater
 -getqlowater
 -getstat
 -gettid
 -lsevent
 -lspolicy
 -setasid asid [cmd]
 -setaudit auid audit_flags termid asid [cmd]
 -setauid auid [cmd]
 -setclass event audit_flags
 -setfsize filesize
 -setkaudit type IP_address
 -setkmask audit_flags
 -setpmask pid audit_flags
 -setpolicy [+|-]policy_flags
 -setqbufsz bufsz
 -setqctrl hiwater lowater bufsz delay
 -setqdelay delay
 -setqhiwater hiwater
 -setqlowater lowater
 -setsmask asid audit_flags
 -setstat
 -setumask user audit_flags
bash-3.2# svcs svc:/system/auditd
STATE          STIME    FMRI
maintenance    16:40:23 svc:/system/auditd:default

# 9  
Old 12-29-2015
Code:
svcs -xv svc:/system/auditd

shows what. It looks like you have a frapped auditd.
# 10  
Old 12-30-2015
Hi

thanks for information.please see below

Code:
bash-3.2# svcs -xv auditd
svc:/system/auditd:default (Solaris audit daemon)
 State: maintenance since Tue Dec 29 16:40:23 2015
Reason: Start method failed repeatedly, last exited with status 98.
   See: http://sun.com/msg/SMF-8000-KS
   See: man -M /usr/share/man -s 1M auditd
   See: man -M /usr/share/man -s 1M audit
   See: /var/svc/log/system-auditd:default.log
Impact: This service is not running.
bash-3.2# cat
^C
bash-3.2# cat /var/svc/log/system-auditd:default.log
[ Feb 13 12:51:00 Disabled. ]
[ Feb 13 12:51:00 Rereading configuration. ]
[ Dec 29 16:40:23 Enabled. ]
[ Dec 29 16:40:23 Executing start method ("/lib/svc/method/svc-auditd") ]
[ Dec 29 16:40:23 Method "start" exited with status 98 ]
[ Dec 29 16:40:23 Executing start method ("/lib/svc/method/svc-auditd") ]
[ Dec 29 16:40:23 Method "start" exited with status 98 ]
[ Dec 29 16:40:23 Executing start method ("/lib/svc/method/svc-auditd") ]
[ Dec 29 16:40:23 Method "start" exited with status 98 ]
[ Dec 29 16:40:23 Stopping for maintenance due to administrative_request. ]
[ Dec 29 16:40:23 Stopping for maintenance due to administrative_request. ]
[ Dec 29 16:40:23 Stopping for maintenance due to administrative_request. ]
[ Dec 29 16:40:23 Stopping for maintenance due to administrative_request. ]
[ Dec 29 16:40:23 Stopping for maintenance due to administrative_request. ]
[ Dec 29 16:40:23 Stopping for maintenance due to administrative_request. ]

Code:
bash-3.2# svcs -l auditd
fmri         svc:/system/auditd:default
name         Solaris audit daemon
enabled      true
state        maintenance
next_state   none
state_time   Tue Dec 29 16:40:23 2015
logfile      /var/svc/log/system-auditd:default.log
restarter    svc:/system/svc/restarter:default
contract_id
dependency   require_all/none svc:/system/filesystem/local (online)
dependency   require_all/none svc:/milestone/name-services (online)
dependency   require_all/none svc:/system/system-log (online)

Login or Register to Ask a Question

Previous Thread | Next Thread

8 More Discussions You Might Find Interesting

1. Solaris

Solaris 11 zone has no external network access (except to Global Zone)

Hi, hoping someone can help, its been a while since I used Solaris. After creating a NGZ (non global zone), the NGZ can access the GZ (Global Zone) and the GZ can access the NGZ (using ssh, zlogin) However, the NGZ cannot access any other netwqork devices, it can't even see the default router ... (2 Replies)
Discussion started by: GazinLincoln
2 Replies

2. Solaris

Date and time change in global and non global zone

Hi, If I change date and time in global zone, then it will affect in non global zones. During this process what files will get affect in non global zones and which mechanism it's using to change. gloabl zone:Solaris 11.3 X86 TIA (1 Reply)
Discussion started by: Sumanthsv
1 Replies

3. Solaris

Global and non-global zone resource sharing - tricky

hi all, Just a simple question but i cant get the answers in the book - In my globalzone , assuming i have 4 cpus (psrinfo -pv = 0-3), if i set dedicated-cpu (ncpus=2) for my local zone Is my globalzone left with 2 cpus or still 4 cpus ? Does localzone "resource reservation.e.g. cpu in... (6 Replies)
Discussion started by: javanoob
6 Replies

4. Solaris

showing 2 different time zones in global zone and nonglobal zone

can some one help me out as it is showing 2 different time zones in global zone and nonglobal zone .In global zone it is showing in GMT while in nonglobal zone i it showing as PDT. System in running with solaris 10 (3 Replies)
Discussion started by: ravijanjanam12
3 Replies

5. Solaris

how to configure a audit in global zone that will audit all the zone

Hi everyone, how i can configure a single audit service in the global zone for all zones, on solaris BSM. I will be glad to hear back from you. Thanks and Regards (3 Replies)
Discussion started by: ladondo
3 Replies

6. Solaris

How to see global hostname by logging in non global zones?

Hi guru Could any one help me by letting me know, how to see global hostname by logging in non global zones Regards (2 Replies)
Discussion started by: girish.batra
2 Replies

7. Solaris

How to access ENV variables of non global zones in global zone???

Hi Guys, My requirement is I have file called /opt/orahome/.profile in non global zone. PATH=/usr/bin:/usr/ucb:/etc:/usr/sbin:/usr/local/bin:/usr/openwin/bin:. export PATH PS1="\${ORACLE_SID}:`hostname`:\$PWD$ " export PS1 EDITOR=vi export EDITOR ENV=/opt/orahome/.kshrc export ENV... (1 Reply)
Discussion started by: vijaysachin
1 Replies

8. Solaris

[b]How to mount a folder from global zone to non global zone??

Hi All There is one folder in global zone I just want to share the same folder innon global zone. How can i do it? pls send me script for this. (2 Replies)
Discussion started by: vijaysachin
2 Replies
Login or Register to Ask a Question