08-03-2011
Thanks. Found out from unix admin that some of the 'jobs' are using cfengine (which i'm not familiar with). Other than those you suggested checking - anything else if using cfengine?
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Hi,
I have been asked if it is possible to track the last time a specific user logged in to the sysetm.
checked my documentation but can't see it there - google is not being very helpful either.
I wonder if someone here can help - it will be much appreciated.
Thanks
Suresh (1 Reply)
Discussion started by: sureshy
1 Replies
2. Solaris
I'm looking for a software to capture my systems logs, and bsm (basic security module) logs to centralise the administration. Do you have a suggestions. Opensource or not. (6 Replies)
Discussion started by: simquest
6 Replies
3. Programming
I have a C program and want to write messages to a log. BSM is being used for O/S auditing. Can I write my messages to the BSM log? If so, how do I do that? I'm not finding any API's for that. Any URLs, samples, guidance would be appreciated. (0 Replies)
Discussion started by: JDO
0 Replies
4. Solaris
I got a lot of this message in my /var/audit log
how can I exclude this message?
header,127,2,invalid event number,fe,hostsol1.com.sg,2007-12-21 00:10:01.001 +08:00,argument,1,0x5,processor ID,argument
,2,0x3,flag,text,P_STATUS,subject,zhang1,root,root,root,root,18228,576129155,291 131094... (1 Reply)
Discussion started by: geoffry
1 Replies
5. UNIX for Advanced & Expert Users
Hi,
I would like to know if there is anyway that I can pinpoint the user before/after he connects to the root? Also, I'm trying to find out what are the commands he inputs under root access. (6 Replies)
Discussion started by: pointgetter0
6 Replies
6. Solaris
Let me preface with I am semi-new to Solaris. I work with it in the labs at work and that's about my extent (although I run Linux at home).
Well, a week ago security comes around with updated requirements, some of which are the need to audit all failures. For the life of me I cannot get a... (0 Replies)
Discussion started by: mph275
0 Replies
7. AIX
Dear All
When I start the AIX(6100-06)audit subsystem.
the log will save in /audit/stream.out (or /audit/trail), but in default when /audit/stream.out to grow up to 150MB.
It will replace the original /audit/stream.out (or /audit/trail).
Then the /audit/stream.out become empty and... (2 Replies)
Discussion started by: nnnnnnine
2 Replies
8. Cybersecurity
Hi All,
Please let me how to enable user specific audit in Linux server.
Say i have specific user namely admin1,admin2,admin3 apart from the normal users, user1,2,3.....userN.
How to enable audit for users admin1,admin2 and admin3 alone.
Also please let me know, if this would have any... (4 Replies)
Discussion started by: pradebban
4 Replies
9. Shell Programming and Scripting
Need some help in coming up to log all the activity that is used with our common "unix account".
Ideally I am looking for to log the activity in a "separate" file for each session or login until the user logout, I would like to capture the date/time and terminal login and record all the ... (3 Replies)
Discussion started by: rajmanna
3 Replies
10. Solaris
Hi all,
I'm trying to read Solaris BSM log in user friendly form. Found old tools including bsmparser java tool and php code. But none of them working. What are you using for parsing BSM log? (2 Replies)
Discussion started by: sembii
2 Replies
AUDIT(2) BSD System Calls Manual AUDIT(2)
NAME
audit -- commit BSM audit record to audit log
SYNOPSIS
#include <bsm/audit.h>
int
audit(const char *record, u_int length);
DESCRIPTION
The audit() system call submits a completed BSM audit record to the system audit log.
The record argument is a pointer to the specific event to be recorded and length is the size in bytes of the data to be written.
RETURN VALUES
Upon successful completion, the value 0 is returned; otherwise the value -1 is returned and the global variable errno is set to indicate the
error.
ERRORS
The audit() system call will fail and the data never written if:
[EFAULT] The record argument is beyond the allocated address space of the process.
[EINVAL] The token ID is invalid or length is larger than MAXAUDITDATA.
[EPERM] The process does not have sufficient permission to complete the operation.
SEE ALSO
auditon(2), getaudit(2), getaudit_addr(2), getauid(2), setaudit(2), setaudit_addr(2), setauid(2), libbsm(3)
HISTORY
The OpenBSM implementation was created by McAfee Research, the security division of McAfee Inc., under contract to Apple Computer Inc. in
2004. It was subsequently adopted by the TrustedBSD Project as the foundation for the OpenBSM distribution.
AUTHORS
This software was created by McAfee Research, the security research division of McAfee, Inc., under contract to Apple Computer Inc. Addi-
tional authors include Wayne Salamon, Robert Watson, and SPARTA Inc.
The Basic Security Module (BSM) interface to audit records and audit event stream format were defined by Sun Microsystems.
This manual page was written by Tom Rhodes <trhodes@FreeBSD.org>.
BUGS
The FreeBSD kernel does not fully validate that the argument passed is syntactically valid BSM. Submitting invalid audit records may corrupt
the audit log.
BSD
April 19, 2005 BSD