Sponsored Content
Top Forums UNIX for Advanced & Expert Users File Auditing in Sun Solaris environment Post 302370161 by mohan_kumarcs on Tuesday 10th of November 2009 03:15:34 PM
Old 11-10-2009
File Auditing in Sun Solaris environment

Hi All,

I have a requirement to report us on changing a group of static files.
Those are the binary files that run in Production every day.

Due to the in sercure environment situations, I found many are indulging in there own changes to the binaries by doing some changes in the souce code.

We have decided to have an audit system for all those files and report a group(send email) on changes in the files we are looking for.

I searched a lot and got the below link:
Linux audit files to see who made changes to a file

But, this needs system admin to enter the picture.

Please let me know, is there a way/script to do the same.

The environment is Sun Solaris E20K.

Regards,
Mohan Kumar CS
 

9 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

speeding up the compilation on SUN Solaris environment

Dear friends, Please let me know how do I increase the speed of my compilation in SUN Solaris environment. actually I have many subfolders which contains .cc files. when I compile makefile at the root it will take much time to compile all the subfolders and generates object(.o) files. Can... (2 Replies)
Discussion started by: swamymns
2 Replies

2. UNIX for Dummies Questions & Answers

solaris BSM and Auditing

Hi Guys, I am new to this forum so I am sorry if i posted this thread in the wrong place. I am currently trying to get BSM to work on solaris 10 by Logging few things for me. I need your help to complete this task please. this is the config of the audit files: audit_conto # Copyright... (18 Replies)
Discussion started by: skywalker850i
18 Replies

3. Solaris

Solaris 9 Auditing

How do I setup audit to alert on write conditions for individual files? Thanks. (3 Replies)
Discussion started by: dxs
3 Replies

4. Programming

Uncompress a gzip and bzip file using java on unix solaris environment

Hi, I need to uncompress a gzip and bzip file using java on unix solaris environment. I also need to retreive the header information of the file inorder to differentiate between gzip and bzip file. Please help Pooja (0 Replies)
Discussion started by: wadhwa.pooja
0 Replies

5. UNIX for Advanced & Expert Users

Solaris auditing (file access logging) for specific directory only.

Hello, We need to log the operations that specific user on Solaris 10 (SPARC) is performing on one directory and it's contents. I was able to configure solaris auditing service (auditd) and it works fine. The only problem is that auditd logs huge amount of unneeded information. We need to log... (0 Replies)
Discussion started by: +Yan
0 Replies

6. Solaris

Solaris user auditing

Hello, I was wondering when Solaris auditing is enabled, If it is possible to keep track of users that are allowed to sudo to root. In other words, I would like to know which user did what on my Solaris box. (assumig that user can "sudo su -" ) Thanks. (2 Replies)
Discussion started by: niyazi
2 Replies

7. Cybersecurity

Solaris Auditing: Newly specified events not being logged

Hi all I'm busy testing auditing on Solaris 10. I am using the syslog plugin to get real time view of what's happening on the system. Initially I am only monitoring lo events. The audit_control file looked like this: dir:/var/audit flags:lo minfree:20 naflags:lo... (1 Reply)
Discussion started by: notreallyhere
1 Replies

8. Solaris

Auditing Sun Servers

Hi All, I am new joinee to this forum and recently promoted as sun administrator from dba. I still dont know whether i can handle it fully . My first task is to audit set of sun servers and findout what it is doing and whether it can be upgraded or decommissioned and if upgraded whether it can... (5 Replies)
Discussion started by: sundba
5 Replies

9. Solaris

Exclude an specific directory for auditing in Solaris 10

Hello, Im glad to become a member of this forums, Im new on solaris and recentrly im introducing to use auditing service in that system. The need is, that I need how to exclude a directory to the audit service not audit it. And, a plus, I need of how to disable auditing the root user in... (0 Replies)
Discussion started by: sysh4ck
0 Replies
getauditflags(3BSM)				      Security and Auditing Library Functions				       getauditflags(3BSM)

NAME
getauditflags, getauditflagsbin, getauditflagschar - convert audit flag specifications SYNOPSIS
cc [ flag... ] file... -lbsm -lsocket -lnsl [ library... ] #include <sys/param.h> #include <bsm/libbsm.h> int getauditflagsbin(char *auditstring, au_mask_t *masks); int getauditflagschar(char *auditstring, au_mask_t *masks, int verbose); DESCRIPTION
The getauditflagsbin() function converts the character representation of audit values pointed to by auditstring into au_mask_t fields pointed to by masks. These fields indicate which events are to be audited when they succeed and which are to be audited when they fail. The character string syntax is described in audit_control(4). The getauditflagschar() function converts the au_mask_t fields pointed to by masks into a string pointed to by auditstring. If verbose is 0, the short (2-character) flag names are used. If verbose is non-zero, the long flag names are used. The auditstring argument should be large enough to contain the ASCII representation of the events. The auditstring argument contains a series of event names, each one identifying a single audit class, separated by commas. The au_mask_t fields pointed to by masks correspond to binary values defined in <bsm/audit.h>, which is read by <bsm/libbsm.h>. RETURN VALUES
Upon successful completion, getauditflagsbin() and getauditflagschar() return 0. Otherwise they return -1. ATTRIBUTES
See attributes(5) for descriptions of the following attributes: +-----------------------------+-----------------------------+ | ATTRIBUTE TYPE | ATTRIBUTE VALUE | +-----------------------------+-----------------------------+ |MT-Level |MT-Safe | +-----------------------------+-----------------------------+ SEE ALSO
bsmconv(1M), audit.log(4), audit_control(4), attributes(5) BUGS
This is not a very extensible interface. NOTES
The functionality described on this manual page is available only if the Solaris Auditing has been enabled. See bsmconv(1M) for more information. SunOS 5.11 31 Mar 2005 getauditflags(3BSM)
All times are GMT -4. The time now is 05:03 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy