12-21-2011
Unfortunately the audit file contains entries which show login times for 8th september 2011 and this incident happened a week back, so we are unable to deduce anything from it.
9 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Hi..
I am new to unix. And I am trying to learn more about admin part of it. We have come across a situation where one of the directory gets deleted everyday at 4:00 pm by some process. We are unable to find out what deletes that directory, seems like a automated job.. but there is nothing... (9 Replies)
Discussion started by: vipas
9 Replies
2. UNIX for Dummies Questions & Answers
Hi,
I need to compare todays file to yesterdays file to find deletes.
I cannot use comm -23 file.old file.new.
Because each record may have a small change in it but is not really a delete.
I have two delimited files. the first field in each file is static. All other fields may change. I... (2 Replies)
Discussion started by: eja
2 Replies
3. UNIX for Dummies Questions & Answers
Is there a command or shell script which can be used for Finding all files created by a specified userid in a directory and its subdirectories.
Say, I want to find all such files in directory /abc as well as in all the subdirectories such as /abc/xyz or /abc/xyz/pqr aqnd so on which was created... (5 Replies)
Discussion started by: abhilashnair
5 Replies
4. Cybersecurity
Hi,
I am trying to write a script which would figure out who has run which command and their IP. As i dont have any clue as to which commands would do this job, i request some gurus to help me on this.
Thanks
Vishwas (2 Replies)
Discussion started by: loggedout
2 Replies
5. UNIX for Dummies Questions & Answers
:) Firstly Hi all!!, im NEW!! and on here hoping that someone might be able to offer me some help... i have a server that keeps crashing every few days with the error message:
PANIC KERNAL-MODE ADDRESS FAULT ON USER ADDRESS 0X14
KERNAL PAGE FAULT FROM (CS:EIP)=(100:EF71B5BD)
EAX=EF822000... (10 Replies)
Discussion started by: Twix
10 Replies
6. AIX
Recently we've had a couple user accounts mysteriously disappear. Is there any way to track these accounts and determine who/how they were deleted? (2 Replies)
Discussion started by: Sk0glund
2 Replies
7. Shell Programming and Scripting
Good morning everybody,
I'm using Minix and I want to find the user with less number of files in the system
I have tried this solution:
#! /bin/sh
indice=0
listaCut=$(cut -f 3 -d : /etc/passwd)
for USER in $listaCut; do
cont=0
listaFind=$(find / -user "${USER}" -type -f)
... (4 Replies)
Discussion started by: Guccio
4 Replies
8. Shell Programming and Scripting
I have been searching, and cannot find an answer for this. I am trying to find all files for a user, lets call him (test001), and I want to exclude a specific directory.
Here is the command I run, it finds all files:
find / -user test001
I get this result:
> find / -user test001 ... (4 Replies)
Discussion started by: steve2x4
4 Replies
9. UNIX for Dummies Questions & Answers
Hello
I have user directories that contain /temp directory.
Example folders:
/user1/temp/
/user2/temp/
/user3/temp/
How can i loop over all user directories and find all files only in their /temp folder?
Thanks a lot for help! (3 Replies)
Discussion started by: flavius42
3 Replies
LEARN ABOUT MOJAVE
audit_user
AUDIT_USER(5) BSD File Formats Manual AUDIT_USER(5)
NAME
audit_user -- events to be audited for given users
DESCRIPTION
The audit_user file specifies which audit event classes are to be audited for the given users. If specified, these flags are combined with
the system-wide audit flags in the audit_control(5) file to determine which classes of events to audit for that user. These settings take
effect when the user logs in.
Each line maps a user name to a list of classes that should be audited and a list of classes that should not be audited. Entries are of the
form:
username:alwaysaudit:neveraudit
In the format above, alwaysaudit is a set of event classes that are always audited, and neveraudit is a set of event classes that should not
be audited. These sets can indicate the inclusion or exclusion of multiple classes, and whether to audit successful or failed events. See
audit_control(5) for more information about audit flags.
Example entries in this file are:
root:lo,ad:no
jdoe:-fc,ad:+fw
These settings would cause login/logout and administrative events that are performed on behalf of user ``root'' to be audited. No failure
events are audited. For the user ``jdoe'', failed file creation events are audited, administrative events are audited, and successful file
write events are never audited.
IMPLEMENTATION NOTES
Per-user and global audit preselection configuration are evaluated at time of login, so users must log out and back in again for audit
changes relating to preselection to take effect.
Audit record preselection occurs with respect to the audit identifier associated with a process, rather than with respect to the UNIX user or
group ID. The audit identifier is set as part of the user credential context as part of login, and typically does not change as a result of
running setuid or setgid applications, such as su(1). This has the advantage that events that occur after running su(1) can be audited to
the original authenticated user, as required by CAPP, but may be surprising if not expected.
FILES
/etc/security/audit_user
SEE ALSO
login(1), su(1), audit(4), audit_class(5), audit_control(5), audit_event(5)
HISTORY
The OpenBSM implementation was created by McAfee Research, the security division of McAfee Inc., under contract to Apple Computer Inc. in
2004. It was subsequently adopted by the TrustedBSD Project as the foundation for the OpenBSM distribution.
AUTHORS
This software was created by McAfee Research, the security research division of McAfee, Inc., under contract to Apple Computer Inc. Addi-
tional authors include Wayne Salamon, Robert Watson, and SPARTA Inc.
The Basic Security Module (BSM) interface to audit records and audit event stream format were defined by Sun Microsystems.
BSD
January 4, 2008 BSD