Why don't you write a script which will monitor the file size of stream.out and if it becomes close to 150MB, the script will make a backup copy of it before the audit subsystem over writes the file?
You may place this in your crontab for executing it in every 30 minutes or so:
Hi all..
I need to perform an audit on my servers (ranging form mdk to redhat, knoppix...). I know there exists somewhere a script that could get me back the info i want..
I've googled around, and haven't found anything interesting.. Anyone have some thing i could investigate?
Thanx
... (5 Replies)
hey guys,
im going to enable C2 auditing on a sun box, i know how to do it, but im just wondering if there are any issues or problems that i may run into. this will be my first major change (since i have to reset the box) since i joined this company and i dont really wanna kill their servers, so... (2 Replies)
Is there a tool or application the will audit users activity? I've tryed to use audit the comes with AIX but to gathers so much information it is near impossible to see what they are doing. I just want to monitor logins and and files they create or change. (9 Replies)
I need to run a DC wide audit of some oracle filesystems to ensure their all on SAN. In linux its pretty easy since its LVM device structure includes the VG for which that lv is part of (/dev/VGFOO/lv-bar). As such I can just run mount and do some greping to get the needed info.
SO my question... (2 Replies)
Hi guys,
I've googled this quite a bit, and tried searching on these forums, but haven't found a solution to my problem. I wanted to inquire about AIX's audit subsystem - more specifically, how to rotate its log file.
So far I've been able to find how to rotate AIX syslog log files, and I... (2 Replies)
Hello Friends,
I had enabled the audit and configured for sysadmin user alone in audit config file. but the audit starts logging for root user alone.
Attached the conf file. I want the aduit to record only for sysadmin activities..
need your expertise and help in solving the issue. (1 Reply)
Hi,
I wish to audit access to a specific folder or file in Solaris.
I have read the man pages for auditd, audit_control , audit_event but don't seem to find any clue.
Has anyone tried this before ? Is it feasible ?
Any advise is appreciated.
Thanks
Yik (5 Replies)
We receive a file which usually has 40 to 50 million rows. I want to set up an audit process by which everytime we receive a file we audit it for # of rows and total number of columns.
So if the # of rows is around 1 million on a particular day, I want to raise a flag or send an email....and if... (3 Replies)
Hi everyone,
how i can configure a single audit service in the global zone for all zones, on solaris BSM.
I will be glad to hear back from you.
Thanks and Regards (3 Replies)
Discussion started by: ladondo
3 Replies
LEARN ABOUT SUNOS
audit
audit(2)audit(2)NAME
audit - write a record to the audit log
SYNOPSIS
cc [ flag ... ] file ... -lbsm -lsocket -lnsl [ library... ]
#include <sys/param.h>
#include <bsm/libbsm.h>
int audit(caddr_t record, int length);
The audit() function is used to write a record to the system audit log. The data pointed to by record is written to the log after a mini-
mal consistency check, with the length parameter specifying the size of the record in bytes. The data should be a well-formed audit
record as described by audit.log(4).
The kernel validates the record header token type and length, and sets the time stamp value before writing the record to the audit log.
The kernel does not do any preselection for user-level generated events. If the audit policy is set to include sequence or trailer
tokens, the kernel will append
them to the record.
Upon successful completion, 0 is returned. Otherwise, -1 is returned and errno is set to indicate the error.
The audit() function will fail if:
EFAULT The record argument points outside the process's allocated address space.
EINVAL The record header token ID is invalid or the length is either less than the header token size or greater than MAXAUDIT-
DATA.
EPERM The {PRIV_PROC_AUDIT} privilege is not asserted in the effective set of the calling process.
USAGE
Only privileged processes can successfully execute this call.
See attributes(5) for descriptions of the following attributes:
+-----------------------------+-----------------------------+
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
+-----------------------------+-----------------------------+
|Interface Stability |Stable |
+-----------------------------+-----------------------------+
|MT-Level |MT-Safe |
+-----------------------------+-----------------------------+
bsmconv(1M), auditd(1M), auditon(2), auditsvc(2), getaudit(2), audit.log(4), attributes(5), privileges(5)
The functionality described in this man page is available only if the Basic Security Module (BSM) has been enabled. See bsmconv(1M) for
more information.
31 Mar 2005 audit(2)