Hello all,
I'm trying to update auditd.cron to force rotate daily and gzip audit.log.1. I will probably then remove anything older that 3 months. The part I don't like about my script right now is the sleep command. It seems that the "/sbin/service auditd rotate" command must use a different shell because the audit.log.1 file is not always there by the time my move command would try to run. That is why I put in the sleep. I tried to capture the process id of the service command($!) and use wait, but that didn't work for me. Wondering if anyone has any ideas about this? FYI, this is on Centos 5.8.
Thanks,
I want to disable the auditd daemon on my unix server. Running this daemon on the server causes to system to crash afer every two month. Could any one let me know step by step how to disable it and is there any implication of doing it? (2 Replies)
Has anyone used, or set up auditd?
I want to use it to audit critical system files.
Will this be hard, how would I start setting this up?
:eek: (2 Replies)
Hello out there!
I'm using dtlogin with my SunRay 2 and SunRay Server Software 4.0.
Now I want to customize the look an funcionality of the dtlogin. e.g. disable the Options - Button or change the Helptext.
Can anybody give me a hint where to find a good manual for dtlogin or which files I... (2 Replies)
Hi,
I have the following my logs:
Nov 20 04:02:04 mail-07 kernel: audit: audit_backlog=326 > audit_backlog_limit=320
Nov 20 04:02:04 mail-07 kernel: audit: audit_lost=4272 audit_rate_limit=0 audit_backlog_limit=320
Nov 20 04:02:04 mail-07 kernel: audit: backlog limit exceeded
Nov 20... (0 Replies)
I'm writing an auditd plugin. In my testing, I enabled pam_tty_audit.
After running test data through it, I notice that when logged in as root, the tty events are sent in real time, and not cached in the event queue.
When running as a user, the events are only spit out by the dispatcher (and... (0 Replies)
Hi forum members,
I have customize command which is opening in one user and while I am try from my user it is not working and getting the message KSH not found.
This command is used to open encrypted file ,this command take arguments file name and option ie plz find the below command.
... (1 Reply)
the events done on the serial console does not get logged. I am using BSM audit.
I have enabled all audit flags. Is there anything that im missing?
Please help!! (2 Replies)
I'm running CentOS 5.x and want to disable this daemon as it's crashing my server daily!
I didn't install that and don't know why it's started magically for some reason.
Please enlighten me to the answer to this question, I've read the man pages on this and found something that stops it... (2 Replies)
Hello all,
I've configured 'audit' service to send the audit logs to a remote log server (by using syslog plugin), which is working fine.
However, there is a problem. audit service also tries to write same information (but in binary format) in /var/audit path.
So, Is there anyway to stop... (2 Replies)
Discussion started by: Anti_Evil
2 Replies
LEARN ABOUT POSIX
audit_data
audit_data(4) File Formats audit_data(4)NAME
audit_data - current information on audit daemon
SYNOPSIS
/etc/security/audit_data
DESCRIPTION
The audit_data file contains information about the audit daemon. The file contains the process ID of the audit daemon, and the pathname of
the current audit log file. The format of the file is:
pid>:<pathname>
Where pid is the process ID for the audit daemon, and pathname is the full pathname for the current audit log file.
EXAMPLES
Example 1: A sample audit_data file.
64:/etc/security/audit/server1/19930506081249.19930506230945.bongos
FILES
/etc/security/audit_data
ATTRIBUTES
See attributes(5) for descriptions of the following attributes:
+-----------------------------+-----------------------------+
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
+-----------------------------+-----------------------------+
|Interface Stability |Obsolete |
+-----------------------------+-----------------------------+
SEE ALSO audit(1M), auditd(1M), bsmconv(1M), audit(2), audit_control(4), audit.log(4)NOTES
The functionality described on this manual page is internal to audit(1M) and might not be supported in a future release.
The auditd utility is the only supported mechanism to communicate with auditd(1M). The current audit log can be determined by examining the
configured audit directories. See audit_control(4).
The functionality described on this manual page is available only if the Basic Security Module (BSM) has been enabled. See bsmconv(1M) for
more information.
SunOS 5.10 14 Nov 2002 audit_data(4)