Why don't you write a script which will monitor the file size of stream.out and if it becomes close to 150MB, the script will make a backup copy of it before the audit subsystem over writes the file?
You may place this in your crontab for executing it in every 30 minutes or so:
Hi all..
I need to perform an audit on my servers (ranging form mdk to redhat, knoppix...). I know there exists somewhere a script that could get me back the info i want..
I've googled around, and haven't found anything interesting.. Anyone have some thing i could investigate?
Thanx
... (5 Replies)
hey guys,
im going to enable C2 auditing on a sun box, i know how to do it, but im just wondering if there are any issues or problems that i may run into. this will be my first major change (since i have to reset the box) since i joined this company and i dont really wanna kill their servers, so... (2 Replies)
Is there a tool or application the will audit users activity? I've tryed to use audit the comes with AIX but to gathers so much information it is near impossible to see what they are doing. I just want to monitor logins and and files they create or change. (9 Replies)
I need to run a DC wide audit of some oracle filesystems to ensure their all on SAN. In linux its pretty easy since its LVM device structure includes the VG for which that lv is part of (/dev/VGFOO/lv-bar). As such I can just run mount and do some greping to get the needed info.
SO my question... (2 Replies)
Hi guys,
I've googled this quite a bit, and tried searching on these forums, but haven't found a solution to my problem. I wanted to inquire about AIX's audit subsystem - more specifically, how to rotate its log file.
So far I've been able to find how to rotate AIX syslog log files, and I... (2 Replies)
Hello Friends,
I had enabled the audit and configured for sysadmin user alone in audit config file. but the audit starts logging for root user alone.
Attached the conf file. I want the aduit to record only for sysadmin activities..
need your expertise and help in solving the issue. (1 Reply)
Hi,
I wish to audit access to a specific folder or file in Solaris.
I have read the man pages for auditd, audit_control , audit_event but don't seem to find any clue.
Has anyone tried this before ? Is it feasible ?
Any advise is appreciated.
Thanks
Yik (5 Replies)
We receive a file which usually has 40 to 50 million rows. I want to set up an audit process by which everytime we receive a file we audit it for # of rows and total number of columns.
So if the # of rows is around 1 million on a particular day, I want to raise a flag or send an email....and if... (3 Replies)
Hi everyone,
how i can configure a single audit service in the global zone for all zones, on solaris BSM.
I will be glad to hear back from you.
Thanks and Regards (3 Replies)
Discussion started by: ladondo
3 Replies
LEARN ABOUT OSF1
audgen
audgen(2) System Calls Manual audgen(2)NAME
audgen - generate an audit record
SYNOPSIS
#include <sys/audit.h>
audgen(
int event,
char *tokenp,
char *argv[],
char *userbuff,
long *size);
DESCRIPTION
The system call generates an audit record.
The argument event is an integer indicating the event type of the operation being audited (see The value of event must be between one of
the following values: MIN_TRUSTED_EVENT and MIN_TRUSTED_EVENT + N_TRUSTED_EVENTS -1 MIN_SITE_EVENT and MIN_SITE_EVENT + n_site_events -1
The number of site-defined events, n_site_events, is determined by the sysconfig sec parameter audit_site_events. Use sysconfig -q sec to
view the security configuration controlled by /etc/sysconfigtab. See aud_sitevent(3) and aud_sitevent_num(3) for information on mapping
site-defined event names and event numbers.
The tokenp argument is a null-terminated array of token_type (see each of which represents the type of argument referenced by the corre-
sponding *argv argument.
The argv argument is a pointer to an array containing either the actual arguments or pointers to those arguments that are to be recorded in
the audit record. A pointer to the actual argument is placed in that array when the argument is a string, array, or other variable length
structure. Arguments represented as an int or a long are placed directly in that array. The available public tokens are listed in the
audit.h file.
If size is nonzero, *size is the size of userbuff provided to audgen, and the audit record created is not passed into the system audit data
stream, but is copied out to userbuff. On return, *size is updated to the number of bytes of data placed into userbuff. If the size of
the audit record exceeds *size, then errno is set to E2BIG. Applications can use this feature to create their own audit records.
RESTRICTIONS
The call is a privileged system call. No record is generated for the system audit data stream if the specified event is not being audited
for the current process. The maximum number of arguments referenced by argv is AUD_NPARAM (128) with no more than 8 of any one token_type.
RETURN VALUES
Upon successful completion, returns a value of 0. Otherwise, it returns a value of -1 and sets the global integer variable errno to indi-
cate the error.
ERRORS
The system call fails under the following conditions:
[EACCES] The user is not privileged for this operation.
[EINVAL] The value supplied for the event, tokenp, or argv argument is invalid.
[E2BIG] The audit record exceeds the audit buffer size.
[ENOSYS] Indicates an attempt to use a system call that is not configured.
[EIO] The tokenmask data is invalid.
[EIO] The size argument is non-zero, and the userbuff argument is invalid.
[EFAULT] A value referenced by the argv argument is invalid.
RELATED INFORMATION
Functions: audgenl(3), aud_sitevent(3), aud_sitevent_num(3)
Commands: audgen(8)
Security delim off
audgen(2)