Audit SUSE Linux 10 Post: 302320139

3 More Discussions You Might Find Interesting

1. AIX

When AIX audit start, How to set the /audit/stream.out file size ?

Dear All When I start the AIX(6100-06)audit subsystem. the log will save in /audit/stream.out (or /audit/trail), but in default when /audit/stream.out to grow up to 150MB. It will replace the original /audit/stream.out (or /audit/trail). Then the /audit/stream.out become empty and...

2. Cybersecurity

Audit on specific user in linux

Hi All, Please let me how to enable user specific audit in Linux server. Say i have specific user namely admin1,admin2,admin3 apart from the normal users, user1,2,3.....userN. How to enable audit for users admin1,admin2 and admin3 alone. Also please let me know, if this would have any...

3. Red Hat

Does Red hat linux 9 has audit rpm package?

Dear All I have a old system run in Red hat Linux 9.. And if it's possible, I want to install the audit rpm package in the Red hat Linux 9. But I can't find the audit-*.rpm file in the Red hat Linux 9's CD..? Can any help me to conform Red hat Linux 9 doesn't support audit? Any...

LEARN ABOUT DEBIAN

subdomain.conf

SUBDOMAIN.CONF(5)						     AppArmor							 SUBDOMAIN.CONF(5)

NAME

       /etc/apparmor/subdomain.conf - configuration file for fine-tuning the behavior of the AppArmor security tool.

DESCRIPTION

       The AppArmor security tool can be configured to have certain default behaviors based on configuration options set in subdomain.conf. There
       are two variables that can be set in subdomain.conf: SUBDOMAIN_PATH, and SUBDOMAIN_MODULE_PANIC.

   SUBDOMAIN_PATH
       This variable accepts a string (path), and is by default set to '/etc/apparmor.d/' This variable defines where the AppArmor security tool
       looks for its policy definitions (a.k.a. AppArmor profiles).

   SUBDOMAIN_MODULE_PANIC
       This variable accepts a string that is one of four values: warn, build, panic, or build-panic, and is set by default to warn.

       This setting controls the behavior of the AppArmor initscript if it cannot successfully load the AppArmor kernel module on startup. The
       four possible settings are:

       warn
	   Log a failure message (the default behavior).

       build
	   Attempt to build the AppArmor module against the currently running kernel. If the compilation is successful, the module will be loaded
	   and AppArmor started; if the compilation fails, a failure message is logged.

       panic
	   Log a failure message and drop to runlevel 1 (single user).

       build-panic
	   Attempt to build the module against the running kernel (like build) and if the compilation fails, drop to runlevel 1 (single user).

BUGS

       Setting the initscript to recompile the module will fail on SUSE, as the module source is no longer installed by default. However, the
       module has been included with the SUSE kernel, so no rebuilding should be necessary.

       If you find any additional bugs, please report them at <http://https://bugs.launchpad.net/apparmor/+filebug>.

SEE ALSO

       apparmor(7), apparmor_parser(8), and <http://wiki.apparmor.net>.

AppArmor 2.7.103						    2012-06-28							 SUBDOMAIN.CONF(5)