11-30-2011
Audit on specific user in linux
Hi All,
Please let me how to enable user specific audit in Linux server.
Say i have specific user namely admin1,admin2,admin3 apart from the normal users, user1,2,3.....userN.
How to enable audit for users admin1,admin2 and admin3 alone.
Also please let me know, if this would have any overload on the server.
Is the overload negligible.
Thanks a lot,
Pradeep.
Last edited by pradebban; 11-30-2011 at 05:20 AM..
Reason: Grammer check :)
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Hi,
I have been asked if it is possible to track the last time a specific user logged in to the sysetm.
checked my documentation but can't see it there - google is not being very helpful either.
I wonder if someone here can help - it will be much appreciated.
Thanks
Suresh (1 Reply)
Discussion started by: sureshy
1 Replies
2. UNIX for Dummies Questions & Answers
Thanks
AVKlinux (3 Replies)
Discussion started by: avklinux
3 Replies
3. SuSE
Dear Team,
If I want to audit SUSE linux 10, who access the file system (e.g. file or delete file)
Did any know how to do it?
HappyDay (3 Replies)
Discussion started by: happyday
3 Replies
4. UNIX for Advanced & Expert Users
Hi,
I would like to know if there is anyway that I can pinpoint the user before/after he connects to the root? Also, I'm trying to find out what are the commands he inputs under root access. (6 Replies)
Discussion started by: pointgetter0
6 Replies
5. Solaris
Hi,
I wish to audit access to a specific folder or file in Solaris.
I have read the man pages for auditd, audit_control , audit_event but don't seem to find any clue.
Has anyone tried this before ? Is it feasible ?
Any advise is appreciated.
Thanks
Yik (5 Replies)
Discussion started by: ycheng08
5 Replies
6. Cybersecurity
Hi,
I keep encountering events in the BSM/C2 logs which shows that the audit-user who performed the event is the user (e.g. ongkk in the example below). However, the user is able to show me that he wasn't logged in at that time nor have the rights to perform the event (e.g. su in this example).... (5 Replies)
Discussion started by: BERNIELEE68
5 Replies
7. UNIX for Advanced & Expert Users
Is there a way to allow a user to use sudo cp on a specific directory and only a specific file? (6 Replies)
Discussion started by: cokedude
6 Replies
8. AIX
Dear All
When I start the AIX(6100-06)audit subsystem.
the log will save in /audit/stream.out (or /audit/trail), but in default when /audit/stream.out to grow up to 150MB.
It will replace the original /audit/stream.out (or /audit/trail).
Then the /audit/stream.out become empty and... (2 Replies)
Discussion started by: nnnnnnine
2 Replies
9. Red Hat
Dear All
I have a old system run in Red hat Linux 9..
And if it's possible, I want to install the audit rpm package in the Red hat Linux 9.
But I can't find the audit-*.rpm file in the Red hat Linux 9's CD..?
Can any help me to conform Red hat Linux 9 doesn't support audit?
Any... (0 Replies)
Discussion started by: nnnnnnine
0 Replies
10. Shell Programming and Scripting
Need some help in coming up to log all the activity that is used with our common "unix account".
Ideally I am looking for to log the activity in a "separate" file for each session or login until the user logout, I would like to capture the date/time and terminal login and record all the ... (3 Replies)
Discussion started by: rajmanna
3 Replies
LEARN ABOUT SUNOS
list-audit-modules
asadmin-list-audit-modules(1AS) User Commands asadmin-list-audit-modules(1AS)
NAME
asadmin-list-audit-modules, list-audit-modules - lists all the audit-modules
SYNOPSIS
list-audit-modules --user admin_user [--password admin_password] [--host localhost] [--port 4848] [--secure|-s] [--passwordfile filename]
[--terse=false] [--echo=false] [--interactive=true]
Lists all the audit modules. This command is supported in remote mode only.
OPTIONS
--user authorized domain application server administrative username.
--password password to administer the domain application server.
--host machine name where the domain application server is running.
--port port number of the domain application server listening for administration requests.
--secure if true, uses SSL/TLS to communicate with the domain application server.
--passwordfile file containing the domain application server password.
--terse indicates that any output data must be very concise, typically avoiding human-friendly sentences and favoring well-
formatted data for consumption by a script. Default is false.
--echo setting to true will echo the command line statement on the standard output. Default is false.
--interactive if set to true (default), only the required password options are prompted.
Example 1: Using list-audit-modules
asadmin> list-audit-modules --user admin1
--password adminadmin1 --host pigeon --port 5001
Command list-audit-modules executed successfully
EXIT STATUS
0 command executed successfully
1 error in executing the command
asadmin-create-audit-module(1AS), asadmin-delete-audit-module(1AS)
J2EE 1.4 SDK March 2004 asadmin-list-audit-modules(1AS)