03-06-2007
Quote:
Originally Posted by skywalker850i
I only need to audit what users execute. Is there an easy way to do it.
You want to add the
ex class to the
flags: in
audit_control so it reads:
flags:lo,ad,cc,ex
Or as you have defined your own audit class (
cc) you could add it to
AUE_EXECVE in
audit_event so it reads:
22:AUE_EXECVE:execve(2):ps,ex,cc
See
this post for more information.
Last edited by auditd; 03-06-2007 at 10:28 AM..
10 More Discussions You Might Find Interesting
1. Solaris
I'm looking for a software to capture my systems logs, and bsm (basic security module) logs to centralise the administration. Do you have a suggestions. Opensource or not. (6 Replies)
Discussion started by: simquest
6 Replies
2. Programming
I have a C program and want to write messages to a log. BSM is being used for O/S auditing. Can I write my messages to the BSM log? If so, how do I do that? I'm not finding any API's for that. Any URLs, samples, guidance would be appreciated. (0 Replies)
Discussion started by: JDO
0 Replies
3. Solaris
I got a lot of this message in my /var/audit log
how can I exclude this message?
header,127,2,invalid event number,fe,hostsol1.com.sg,2007-12-21 00:10:01.001 +08:00,argument,1,0x5,processor ID,argument
,2,0x3,flag,text,P_STATUS,subject,zhang1,root,root,root,root,18228,576129155,291 131094... (1 Reply)
Discussion started by: geoffry
1 Replies
4. Solaris
How do I setup audit to alert on write conditions for individual files? Thanks. (3 Replies)
Discussion started by: dxs
3 Replies
5. Solaris
Hello,
I was wondering when Solaris auditing is enabled, If it is possible to keep track of users that are allowed to sudo to root. In other words, I would like to know which user did what on my Solaris box. (assumig that user can "sudo su -" )
Thanks. (2 Replies)
Discussion started by: niyazi
2 Replies
6. Solaris
Let me preface with I am semi-new to Solaris. I work with it in the labs at work and that's about my extent (although I run Linux at home).
Well, a week ago security comes around with updated requirements, some of which are the need to audit all failures. For the life of me I cannot get a... (0 Replies)
Discussion started by: mph275
0 Replies
7. Solaris
Hi ,
I don't want logs from a particular "library" to get recorded in the audit.log file. Is that possible with BSM? Please guide.
Thanks. (2 Replies)
Discussion started by: chinchao
2 Replies
8. Solaris
New to Solaris in general (coming from a RHEL background) I'm trying to enable auditing on the system with the following in /etc/security/audit_control:
But there are two areas where it seems to break with expected behavior (maybe it's poor expectations on my part):
1) it seems to be... (0 Replies)
Discussion started by: thmnetwork
0 Replies
9. Solaris
Hi all,
I'm trying to read Solaris BSM log in user friendly form. Found old tools including bsmparser java tool and php code. But none of them working. What are you using for parsing BSM log? (2 Replies)
Discussion started by: sembii
2 Replies
10. Solaris
Hello,
Im glad to become a member of this forums,
Im new on solaris and recentrly im introducing to use auditing service in that system.
The need is, that I need how to exclude a directory to the audit service not audit it.
And, a plus, I need of how to disable auditing the root user in... (0 Replies)
Discussion started by: sysh4ck
0 Replies
LEARN ABOUT DEBIAN
blockdiag
BLOCKDIAG(1) General Commands Manual BLOCKDIAG(1)
NAME
blockdiag - generate block-diagram image file from spec-text file.
SYNOPSIS
blockdiag [options] file
DESCRIPTION
This manual page documents briefly the blockdiag commands.
blockdiag is a program that generate block-diagram image file from spec-text file.
OPTIONS
These programs follow the usual GNU command line syntax, with long options starting with two dashes (`-'). A summary of options is
included below. For a complete description, see the SEE ALSO.
--version
show program's version number and exit
-h, --help
Show summary of options
-a, --antialias
Pass diagram image to anti-alias filter
-c FILE, --config=FILE
read configurations from FILE
-o FILE
write diagram to FILE
-f FONT, --font=FONT
use FONT to draw diagram
--fontmap=FONT
use FONTMAP file to draw diagram
-s, --separate
Separate diagram images for each group
-T TYPE
Output diagram as TYPE format
--nodoctype
Do not output doctype definition tags (SVG only)
--no-transparency
do not make transparent background of diagram (PNG only)
SEE ALSO
The programs are documented fully by
http://tk0miya.bitbucket.org/blockdiag/build/html/index.html
AUTHOR
blockdiag was written by Takeshi Komiya <i.tkomiya@gmail.com>
This manual page was written by Kouhei Maeda <mkouhei@palmtb.net>, for the Debian project (and may be used by others).
May 9, 2011 BLOCKDIAG(1)