Sponsored Content
Full Discussion: audit user in BSM/C2 Log
Special Forums Cybersecurity audit user in BSM/C2 Log Post 302544067 by BERNIELEE68 on Tuesday 2nd of August 2011 10:24:58 PM
Old 08-02-2011
audit user in BSM/C2 Log

Hi,

I keep encountering events in the BSM/C2 logs which shows that the audit-user who performed the event is the user (e.g. ongkk in the example below). However, the user is able to show me that he wasn't logged in at that time nor have the rights to perform the event (e.g. su in this example).

I suspect this is generated by a scheduled script which runs daily and it was the way the job was set up. How can I check/confirm that?

header,96,2,su,,simux65.ext.com,2011-06-24 23:36:00.598 +08:00,subject,ongkk,root,root,root,root,29685,1110674129,612 65558 10.88.xx.yy,text,success for user oracle,return,success,0
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

audit user activity - possible?

Hi, I have been asked if it is possible to track the last time a specific user logged in to the sysetm. checked my documentation but can't see it there - google is not being very helpful either. I wonder if someone here can help - it will be much appreciated. Thanks Suresh (1 Reply)
Discussion started by: sureshy
1 Replies

2. Solaris

Solaris BSM log software

I'm looking for a software to capture my systems logs, and bsm (basic security module) logs to centralise the administration. Do you have a suggestions. Opensource or not. (6 Replies)
Discussion started by: simquest
6 Replies

3. Programming

how to write to Solaris BSM log

I have a C program and want to write messages to a log. BSM is being used for O/S auditing. Can I write my messages to the BSM log? If so, how do I do that? I'm not finding any API's for that. Any URLs, samples, guidance would be appreciated. (0 Replies)
Discussion started by: JDO
0 Replies

4. Solaris

Solaris BSM audit log

I got a lot of this message in my /var/audit log how can I exclude this message? header,127,2,invalid event number,fe,hostsol1.com.sg,2007-12-21 00:10:01.001 +08:00,argument,1,0x5,processor ID,argument ,2,0x3,flag,text,P_STATUS,subject,zhang1,root,root,root,root,18228,576129155,291 131094... (1 Reply)
Discussion started by: geoffry
1 Replies

5. UNIX for Advanced & Expert Users

audit user commands of different users under root account

Hi, I would like to know if there is anyway that I can pinpoint the user before/after he connects to the root? Also, I'm trying to find out what are the commands he inputs under root access. (6 Replies)
Discussion started by: pointgetter0
6 Replies

6. Solaris

BSM auditing issues, need to audit "permission denied"

Let me preface with I am semi-new to Solaris. I work with it in the labs at work and that's about my extent (although I run Linux at home). Well, a week ago security comes around with updated requirements, some of which are the need to audit all failures. For the life of me I cannot get a... (0 Replies)
Discussion started by: mph275
0 Replies

7. AIX

When AIX audit start, How to set the /audit/stream.out file size ?

Dear All When I start the AIX(6100-06)audit subsystem. the log will save in /audit/stream.out (or /audit/trail), but in default when /audit/stream.out to grow up to 150MB. It will replace the original /audit/stream.out (or /audit/trail). Then the /audit/stream.out become empty and... (2 Replies)
Discussion started by: nnnnnnine
2 Replies

8. Cybersecurity

Audit on specific user in linux

Hi All, Please let me how to enable user specific audit in Linux server. Say i have specific user namely admin1,admin2,admin3 apart from the normal users, user1,2,3.....userN. How to enable audit for users admin1,admin2 and admin3 alone. Also please let me know, if this would have any... (4 Replies)
Discussion started by: pradebban
4 Replies

9. Shell Programming and Scripting

Audit user activity

Need some help in coming up to log all the activity that is used with our common "unix account". Ideally I am looking for to log the activity in a "separate" file for each session or login until the user logout, I would like to capture the date/time and terminal login and record all the ... (3 Replies)
Discussion started by: rajmanna
3 Replies

10. Solaris

How can I read Solaris BSM log?

Hi all, I'm trying to read Solaris BSM log in user friendly form. Found old tools including bsmparser java tool and php code. But none of them working. What are you using for parsing BSM log? (2 Replies)
Discussion started by: sembii
2 Replies
XTERMCONTROL(1) 						   User Commands						   XTERMCONTROL(1)

NAME
xtermcontrol - dynamic control of XFree86 xterm properties. SYNOPSIS
xtermcontrol [OPTIONS]... DESCRIPTION
xtermcontrol makes it easy to change colors, title, font and geometry of a running XFree86 xterm(1), as well as to report the current set- tings of the aforementioned properties. Window manipulations de-/iconify, raise/lower, maximize/restore and reset are also supported. To complete the feature set; xtermcontrol lets advanced users issue any xterm control sequence of their choosing. OPTIONS
--fg=COLOR Set foreground color (see also COLOR NAMES). --bg=COLOR Set background color. --colorN=COLOR Set N'th [0-15] color. --highlight=COLOR Set highlight color. --cursor=COLOR Set cursor color. --mouse-fg=COLOR Set mouse pointer foreground color. --mouse-bg=COLOR Set mouse pointer background color. --font=FONT Set font name (see also FONT NAMES). Alternatively it is possible to specify a fontmenu index as '#[0-6]' or navigate the fontmenu by relative sizes as '#+N' or '#-N', where N is an optional integer. --title=STRING Set window title. Note that mechanisms like the bash(1) PROMPT_COMMAND may overwrite the title. --geometry=WIDTHxHEIGHT+XOFF+YOFF Set size and/or position. Through its control sequences the xterm only recognize positive XOFF and YOFF offsets, which are pixels relative to the upper left hand corner of the display. xtermcontrol is therefore unable to handle negative offsets as described in the X(7x) GEOMETRY SPECIFICATIONS and therefore truncates negative values to zero. --get-fg Report foreground color. --get-bg Report background color. --get-colorN Report N'th [0-15] color. --get-highlight Report highlight color. --get-cursor Report cursor color. --get-mouse-fg Report mouse pointer foreground color. --get-mouse-bg Report mouse pointer background color. --get-font Report font. --get-title Report window title. --get-geometry Report size and position. The size of the text area is reported in characters and the position is reported in pixels relative to the upper left hand corner of the display. --maximize Maximize window. --restore Restore maximized window. --iconify Iconify window. --de-iconify De-iconify window. --raise Raise window. --lower Lower window. --reset Full reset. --raw=CTLSEQS Issue raw control sequence (see also XTERM CONTROL SEQUENCES). --file=FILE Force xtermcontrol to read configurations (see also CONFIGURATION) from FILE instead of the standard personal initialization file ~/.xtermcontrol. --force, -f Skip TERM environment variable check. --verbose, -v Print verbose reports. --help, -h Print help message and exit. --version Print the version number and exit. CONFIGURATION
xtermcontrol reads a default, ~/.xtermcontrol, or a user specified configuration file on startup. Each line in the file is either a com- ment or contains an attribute. Attributes consist of a keyword and an associated value: keyword = value # comment The valid keyword/value combinations are: foreground="COLOR" background="COLOR" highlight="COLOR" cursor="COLOR" mouse-foreground="COLOR" mouse-background="COLOR" geometry="WIDTHxHEIGHT+XOFF+YOFF" font="FONT" color0="COLOR" color1="COLOR" color2="COLOR" color3="COLOR" color4="COLOR" color5="COLOR" color6="COLOR" color7="COLOR" color8="COLOR" color9="COLOR" color10="COLOR" color11="COLOR" color12="COLOR" color13="COLOR" color14="COLOR" color15="COLOR" Whitespace is ignored in attributes unless within a quoted value. The character '#' is taken to begin a comment. Each '#' and all remaining characters on that line is ignored. FONT NAMES
xtermcontrol accepts any X(7x) FONT NAMES. Font names like '-adobe-courier-medium-r-normal--10-100-75-75-m-60-iso8859-1' are very cumber- some to write, so it is convenient to make use of aliases, e.g. 'fixed' or '8x13', if present in fonts.alias files of the font directo- ries. COLOR NAMES
xtermcontrol accepts any X(7x) COLOR NAMES. Basically this means that colors are specified by name or rgb value, e.g. 'blue', 'rgb:0000/0000/FFFF' or '#00F'. Colors are typically reported by the xterm in a device-dependent numerical form, e.g. 'rgb:0000/0000/FFFF'. Note that old syntax rgb values should always be quoted to avoid '#' being interpreted as the beginning of a comment by the shell (see also FILES). XTERM CONTROL SEQUENCES
The secret behind xtermcontrol is xterm control sequences. All the possible (there are a plethora of them) control sequences are documented in ctlseqs.txt, found in the xterm(1) distribution (see also FILES). TROUBLESHOOTING
If read/write permissions on the tty's are changed so that special group membership is required to be able to write to the pseudo terminal, the easiest workaround is to install xtermcontrol setuid root. Xterm(1) has three resources, allowWindowOps, allowTitleOps, and allowFontOps, that enables or disables special operations which xtermcon- trol relies on. If any of these resources are set (or defaults) to 'false' xtermcontrol may hang. The resources corresponds to xtermcon- trol options as: allowWindowOps: --raise --lower --restore --maximize --iconify --de-iconify --get-title --geometry --get-geometry allowTitleOps: --title allowFontOps: --font --get-font All three resources can usually be enabled for the current xterm session via a menu; ctrl+rightclick and look for menu item names like 'Allow Window Ops'. To set these resource values persistently you can add the following to either your local ~/.Xdefaults file, or to a system-wide resource file like /etc/X11/app-defaults/XTerm: *VT100.allowWindowOps: true *VT100.allowTitleOps: true *VT100.allowFontOps: true FILES
<XRoot>/X11/rgb.txt Default rgb color name file location. ctlseqs.txt Xterm control sequences documentation. Distributed with xterm from http://dickey.his.com/xterm/ SEE ALSO
xterm(1), X(7x) COPYRIGHT
Copyright (C) 2002-2009 Jess Thrysoee <jess@thrysoee.dk> xtermcontrol 2.10 October 17, 2009 XTERMCONTROL(1)
All times are GMT -4. The time now is 01:43 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy