auditd Post: 302126862

Sponsored Content

Operating Systems Linux Red Hat auditd Post 302126862 by syndex on Friday 13th of July 2007 03:44:09 PM

07-13-2007

Registered User

Everytime I do

Auditctl -l

I get

linux101:/etc # auditctl -l
No rules
File system watches not supported

Here is my audit.rules

linux101:/etc # cat audit.rules
# This file contains the auditctl rules that are loaded
# whenever the audit daemon is started via the initscripts.
# The rules are simply the parameters that would be passed
# to auditctl.

# First rule - delete all
-D

# Feel free to add below this line. See auditctl man page

# Increase the buffers to survive stress events
-b 256

Here is my auditd.conf

lxt-sles101:/etc # cat auditd.conf
#
# This file controls the configuration of the audit daemon
#

log_file = /var/log/audit/audit.log
log_format = RAW
priority_boost = 3
flush = INCREMENTAL
freq = 20
num_logs = 4
#dispatcher = /usr/sbin/audispd
max_log_file = 5
max_log_file_action = ROTATE
space_left = 75
space_left_action = SYSLOG
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND

What am I doing wrong? Smilie

syndex

View Public Profile for syndex

Find all posts by syndex

9 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

how to disable auditd daemon

I want to disable the auditd daemon on my unix server. Running this daemon on the server causes to system to crash afer every two month. Could any one let me know step by step how to disable it and is there any implication of doing it?

2. Linux

sending messages from auditd logs to syslog server

I have the auditd running and I need to send the audit logs to a remote syslog server. Anyideas on how to do that?

3. UNIX for Dummies Questions & Answers

Auditd problem

Hi, I have the following my logs: Nov 20 04:02:04 mail-07 kernel: audit: audit_backlog=326 > audit_backlog_limit=320 Nov 20 04:02:04 mail-07 kernel: audit: audit_lost=4272 audit_rate_limit=0 audit_backlog_limit=320 Nov 20 04:02:04 mail-07 kernel: audit: backlog limit exceeded Nov 20...

4. Red Hat

Auditd event cache

I'm writing an auditd plugin. In my testing, I enabled pam_tty_audit. After running test data through it, I notice that when logged in as root, the tty events are sent in real time, and not cached in the event queue. When running as a user, the events are only spit out by the dispatcher (and...

5. Cybersecurity

Events done on the serial console does not get recorded via the auditd

the events done on the serial console does not get logged. I am using BSM audit. I have enabled all audit flags. Is there anything that im missing? Please help!!

6. UNIX for Dummies Questions & Answers

Auditd (How to disable)

I'm running CentOS 5.x and want to disable this daemon as it's crashing my server daily! I didn't install that and don't know why it's started magically for some reason. Please enlighten me to the answer to this question, I've read the man pages on this and found something that stops it...

7. Solaris

Configuring 'auditd' service to not store the audit logs in /var partition

Hello all, I've configured 'audit' service to send the audit logs to a remote log server (by using syslog plugin), which is working fine. However, there is a problem. audit service also tries to write same information (but in binary format) in /var/audit path. So, Is there anyway to stop...

8. Shell Programming and Scripting

Trying to customize auditd.cron

Hello all, I'm trying to update auditd.cron to force rotate daily and gzip audit.log.1. I will probably then remove anything older that 3 months. The part I don't like about my script right now is the sleep command. It seems that the "/sbin/service auditd rotate" command must use a different...

9. Shell Programming and Scripting

Script to update rsyslog.conf and auditd.conf

Hello all, Newbie here. I'm currently tasked with updating rsyslog.conf and auditd.conf on a large set of servers. I know the exact logging configurations that I want to enable. I have updated both files on on a server and hope to use the updated files as a template for the rest of the...

LEARN ABOUT X11R4

autrace

AUTRACE:(8)						  System Administration Utilities					       AUTRACE:(8)

NAME

       autrace - a program similar to strace

SYNOPSIS

       autrace program [-r] [program-args]...

DESCRIPTION

       autrace is a program that will add the audit rules to trace a process similar to strace. It will then execute the program passing arguments
       to it. The resulting audit information will be in the audit logs if the audit daemon is running or syslog. This command deletes	all  audit
       rules  prior  to  executing the target program and after executing it. As a safety precaution, it will not run unless all rules are deleted
       with auditctl prior to use.

OPTIONS

       -r     Limit syscalls collected to ones needed for analyzing resource usage. This could help people doing threat modeling. This saves space
	      in logs.

EXAMPLES

       The following illustrates a typical session:

       autrace /bin/ls /tmp
       ausearch --start recent -p 2442 -i

       and for resource usage mode:

       autrace -r /bin/ls
       ausearch --start recent -p 2450 --raw | aureport --file --summary
       ausearch --start recent -p 2450 --raw | aureport --host --summary

SEE ALSO

       ausearch(8), auditctl(8).

AUTHOR

       Steve Grubb

Red Hat 							     Jan 2007							       AUTRACE:(8)