01-12-2012
Hi,
I need to audit which user (with ip) has logged in and what files have he edited/deleted. This is available as a part of unix, but it enables the logs for all users, which i need to edit for only certain users.
Thanks,
Pradeep
10 More Discussions You Might Find Interesting
1. UNIX for Dummies Questions & Answers
Hi,
I have been asked if it is possible to track the last time a specific user logged in to the sysetm.
checked my documentation but can't see it there - google is not being very helpful either.
I wonder if someone here can help - it will be much appreciated.
Thanks
Suresh (1 Reply)
Discussion started by: sureshy
1 Replies
2. UNIX for Dummies Questions & Answers
Thanks
AVKlinux (3 Replies)
Discussion started by: avklinux
3 Replies
3. SuSE
Dear Team,
If I want to audit SUSE linux 10, who access the file system (e.g. file or delete file)
Did any know how to do it?
HappyDay (3 Replies)
Discussion started by: happyday
3 Replies
4. UNIX for Advanced & Expert Users
Hi,
I would like to know if there is anyway that I can pinpoint the user before/after he connects to the root? Also, I'm trying to find out what are the commands he inputs under root access. (6 Replies)
Discussion started by: pointgetter0
6 Replies
5. Solaris
Hi,
I wish to audit access to a specific folder or file in Solaris.
I have read the man pages for auditd, audit_control , audit_event but don't seem to find any clue.
Has anyone tried this before ? Is it feasible ?
Any advise is appreciated.
Thanks
Yik (5 Replies)
Discussion started by: ycheng08
5 Replies
6. Cybersecurity
Hi,
I keep encountering events in the BSM/C2 logs which shows that the audit-user who performed the event is the user (e.g. ongkk in the example below). However, the user is able to show me that he wasn't logged in at that time nor have the rights to perform the event (e.g. su in this example).... (5 Replies)
Discussion started by: BERNIELEE68
5 Replies
7. UNIX for Advanced & Expert Users
Is there a way to allow a user to use sudo cp on a specific directory and only a specific file? (6 Replies)
Discussion started by: cokedude
6 Replies
8. AIX
Dear All
When I start the AIX(6100-06)audit subsystem.
the log will save in /audit/stream.out (or /audit/trail), but in default when /audit/stream.out to grow up to 150MB.
It will replace the original /audit/stream.out (or /audit/trail).
Then the /audit/stream.out become empty and... (2 Replies)
Discussion started by: nnnnnnine
2 Replies
9. Red Hat
Dear All
I have a old system run in Red hat Linux 9..
And if it's possible, I want to install the audit rpm package in the Red hat Linux 9.
But I can't find the audit-*.rpm file in the Red hat Linux 9's CD..?
Can any help me to conform Red hat Linux 9 doesn't support audit?
Any... (0 Replies)
Discussion started by: nnnnnnine
0 Replies
10. Shell Programming and Scripting
Need some help in coming up to log all the activity that is used with our common "unix account".
Ideally I am looking for to log the activity in a "separate" file for each session or login until the user logout, I would like to capture the date/time and terminal login and record all the ... (3 Replies)
Discussion started by: rajmanna
3 Replies
LEARN ABOUT FREEBSD
audit_user
AUDIT_USER(5) BSD File Formats Manual AUDIT_USER(5)
NAME
audit_user -- events to be audited for given users
DESCRIPTION
The audit_user file specifies which audit event classes are to be audited for the given users. If specified, these flags are combined with
the system-wide audit flags in the audit_control(5) file to determine which classes of events to audit for that user. These settings take
effect when the user logs in.
Each line maps a user name to a list of classes that should be audited and a list of classes that should not be audited. Entries are of the
form:
username:alwaysaudit:neveraudit
In the format above, alwaysaudit is a set of event classes that are always audited, and neveraudit is a set of event classes that should not
be audited. These sets can indicate the inclusion or exclusion of multiple classes, and whether to audit successful or failed events. See
audit_control(5) for more information about audit flags.
Example entries in this file are:
root:lo,ad:no
jdoe:-fc,ad:+fw
These settings would cause login/logout and administrative events that are performed on behalf of user ``root'' to be audited. No failure
events are audited. For the user ``jdoe'', failed file creation events are audited, administrative events are audited, and successful file
write events are never audited.
IMPLEMENTATION NOTES
Per-user and global audit preselection configuration are evaluated at time of login, so users must log out and back in again for audit
changes relating to preselection to take effect.
Audit record preselection occurs with respect to the audit identifier associated with a process, rather than with respect to the UNIX user or
group ID. The audit identifier is set as part of the user credential context as part of login, and typically does not change as a result of
running setuid or setgid applications, such as su(1). This has the advantage that events that occur after running su(1) can be audited to
the original authenticated user, as required by CAPP, but may be surprising if not expected.
FILES
/etc/security/audit_user
SEE ALSO
login(1), su(1), audit(4), audit_class(5), audit_control(5), audit_event(5)
HISTORY
The OpenBSM implementation was created by McAfee Research, the security division of McAfee Inc., under contract to Apple Computer Inc. in
2004. It was subsequently adopted by the TrustedBSD Project as the foundation for the OpenBSM distribution.
AUTHORS
This software was created by McAfee Research, the security research division of McAfee, Inc., under contract to Apple Computer Inc. Addi-
tional authors include Wayne Salamon, Robert Watson, and SPARTA Inc.
The Basic Security Module (BSM) interface to audit records and audit event stream format were defined by Sun Microsystems.
BSD
January 4, 2008 BSD