Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Trying to customize auditd.cron
Top Forums Shell Programming and Scripting Trying to customize auditd.cron Post 302911596 by cdlaforc on Friday 1st of August 2014 03:14:56 PM
Old 08-01-2014
Trying to customize auditd.cron
Hello all,
I'm trying to update auditd.cron to force rotate daily and gzip audit.log.1. I will probably then remove anything older that 3 months. The part I don't like about my script right now is the sleep command. It seems that the "/sbin/service auditd rotate" command must use a different shell because the audit.log.1 file is not always there by the time my move command would try to run. That is why I put in the sleep. I tried to capture the process id of the service command($!) and use wait, but that didn't work for me. Wondering if anyone has any ideas about this? FYI, this is on Centos 5.8.
Thanks,

Code:
#!/bin/bash
#
#auditd.cron
#
#-------------------------------------------------------------------
# This function is called whenever a program in this script
# returns a non-zero status.
#-------------------------------------------------------------------
doexit()
{
        echo '************************************************'
        echo ' FATAL ERROR !'
        echo '************************************************'
        exit 255
}
#
set -vax
#
curdttm=`date +%Y%m%d%H%M%S`
#
##########
# This script can be installed to get a daily log rotation
# based on a cron job.
##########
#
/sbin/service auditd rotate
#
EXITVALUE=$?
#
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t auditd "ALERT exited abnormally with [$EXITVALUE]"
    doexit
fi
#
# Wait for log to rotate
sleep 60
#
mv /var/log/audit/audit.log.1 /var/log/audit/audit.log.${curdttm}
#
#
if [ $? -ne 0 ]; then doexit ; fi
#
/bin/gzip -9 /var/log/audit/audit.log.${curdttm}
#
if [ $? -ne 0 ]; then doexit ; fi
#
exit 0

 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

how to disable auditd daemon

I want to disable the auditd daemon on my unix server. Running this daemon on the server causes to system to crash afer every two month. Could any one let me know step by step how to disable it and is there any implication of doing it? (2 Replies)
Discussion started by: skumar11
2 Replies

2. Red Hat

auditd

Has anyone used, or set up auditd? I want to use it to audit critical system files. Will this be hard, how would I start setting this up? :eek: (2 Replies)
Discussion started by: syndex
2 Replies

3. Solaris

customize dtlogin

Hello out there! I'm using dtlogin with my SunRay 2 and SunRay Server Software 4.0. Now I want to customize the look an funcionality of the dtlogin. e.g. disable the Options - Button or change the Helptext. Can anybody give me a hint where to find a good manual for dtlogin or which files I... (2 Replies)
Discussion started by: Blang
2 Replies

4. Linux

sending messages from auditd logs to syslog server

I have the auditd running and I need to send the audit logs to a remote syslog server. Anyideas on how to do that? (1 Reply)
Discussion started by: jmathenge
1 Replies

5. UNIX for Dummies Questions & Answers

Auditd problem

Hi, I have the following my logs: Nov 20 04:02:04 mail-07 kernel: audit: audit_backlog=326 > audit_backlog_limit=320 Nov 20 04:02:04 mail-07 kernel: audit: audit_lost=4272 audit_rate_limit=0 audit_backlog_limit=320 Nov 20 04:02:04 mail-07 kernel: audit: backlog limit exceeded Nov 20... (0 Replies)
Discussion started by: mojoman
0 Replies

6. Red Hat

Auditd event cache

I'm writing an auditd plugin. In my testing, I enabled pam_tty_audit. After running test data through it, I notice that when logged in as root, the tty events are sent in real time, and not cached in the event queue. When running as a user, the events are only spit out by the dispatcher (and... (0 Replies)
Discussion started by: tahoekid
0 Replies

7. Shell Programming and Scripting

help me with customize script.

Hi forum members, I have customize command which is opening in one user and while I am try from my user it is not working and getting the message KSH not found. This command is used to open encrypted file ,this command take arguments file name and option ie plz find the below command. ... (1 Reply)
Discussion started by: sivaranga001
1 Replies

8. Cybersecurity

Events done on the serial console does not get recorded via the auditd

the events done on the serial console does not get logged. I am using BSM audit. I have enabled all audit flags. Is there anything that im missing? Please help!! (2 Replies)
Discussion started by: chinchao
2 Replies

9. UNIX for Dummies Questions & Answers

Auditd (How to disable)

I'm running CentOS 5.x and want to disable this daemon as it's crashing my server daily! I didn't install that and don't know why it's started magically for some reason. Please enlighten me to the answer to this question, I've read the man pages on this and found something that stops it... (2 Replies)
Discussion started by: HiphopTech
2 Replies

10. Solaris

Configuring 'auditd' service to not store the audit logs in /var partition

Hello all, I've configured 'audit' service to send the audit logs to a remote log server (by using syslog plugin), which is working fine. However, there is a problem. audit service also tries to write same information (but in binary format) in /var/audit path. So, Is there anyway to stop... (2 Replies)
Discussion started by: Anti_Evil
2 Replies

LEARN ABOUT MINIX

audit_data

audit_data(4)							   File Formats 						     audit_data(4)

NAME

       audit_data - current information on audit daemon

SYNOPSIS

       /etc/security/audit_data

DESCRIPTION

       The  audit_data file contains information about the audit daemon. The file contains the process ID of the audit daemon, and the pathname of
       the current audit log file. The format of the file is:

	      pid>:<pathname>

       Where pid is the process ID for the audit daemon, and pathname is the full pathname for the current audit log file.

EXAMPLES

       Example 1: A sample audit_data file.

       64:/etc/security/audit/server1/19930506081249.19930506230945.bongos

FILES

       /etc/security/audit_data

ATTRIBUTES

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE	     |	    ATTRIBUTE VALUE	   |
       +-----------------------------+-----------------------------+
       |Interface Stability	     |Obsolete			   |
       +-----------------------------+-----------------------------+

SEE ALSO

       audit(1M), auditd(1M), bsmconv(1M), audit(2), audit_control(4), audit.log(4)

NOTES

       The functionality described on this manual page is internal to audit(1M) and might not be supported in a future release.

       The auditd utility is the only supported mechanism to communicate with auditd(1M). The current audit log can be determined by examining the
       configured audit directories. See audit_control(4).

       The  functionality described on this manual page is available only if the Basic Security Module (BSM) has been enabled. See bsmconv(1M) for
       more information.

SunOS 5.10							    14 Nov 2002 						     audit_data(4)
All times are GMT -4. The time now is 08:25 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy