Hello all,
I'm trying to update auditd.cron to force rotate daily and gzip audit.log.1. I will probably then remove anything older that 3 months. The part I don't like about my script right now is the sleep command. It seems that the "/sbin/service auditd rotate" command must use a different shell because the audit.log.1 file is not always there by the time my move command would try to run. That is why I put in the sleep. I tried to capture the process id of the service command($!) and use wait, but that didn't work for me. Wondering if anyone has any ideas about this? FYI, this is on Centos 5.8.
Thanks,
I want to disable the auditd daemon on my unix server. Running this daemon on the server causes to system to crash afer every two month. Could any one let me know step by step how to disable it and is there any implication of doing it? (2 Replies)
Has anyone used, or set up auditd?
I want to use it to audit critical system files.
Will this be hard, how would I start setting this up?
:eek: (2 Replies)
Hello out there!
I'm using dtlogin with my SunRay 2 and SunRay Server Software 4.0.
Now I want to customize the look an funcionality of the dtlogin. e.g. disable the Options - Button or change the Helptext.
Can anybody give me a hint where to find a good manual for dtlogin or which files I... (2 Replies)
Hi,
I have the following my logs:
Nov 20 04:02:04 mail-07 kernel: audit: audit_backlog=326 > audit_backlog_limit=320
Nov 20 04:02:04 mail-07 kernel: audit: audit_lost=4272 audit_rate_limit=0 audit_backlog_limit=320
Nov 20 04:02:04 mail-07 kernel: audit: backlog limit exceeded
Nov 20... (0 Replies)
I'm writing an auditd plugin. In my testing, I enabled pam_tty_audit.
After running test data through it, I notice that when logged in as root, the tty events are sent in real time, and not cached in the event queue.
When running as a user, the events are only spit out by the dispatcher (and... (0 Replies)
Hi forum members,
I have customize command which is opening in one user and while I am try from my user it is not working and getting the message KSH not found.
This command is used to open encrypted file ,this command take arguments file name and option ie plz find the below command.
... (1 Reply)
the events done on the serial console does not get logged. I am using BSM audit.
I have enabled all audit flags. Is there anything that im missing?
Please help!! (2 Replies)
I'm running CentOS 5.x and want to disable this daemon as it's crashing my server daily!
I didn't install that and don't know why it's started magically for some reason.
Please enlighten me to the answer to this question, I've read the man pages on this and found something that stops it... (2 Replies)
Hello all,
I've configured 'audit' service to send the audit logs to a remote log server (by using syslog plugin), which is working fine.
However, there is a problem. audit service also tries to write same information (but in binary format) in /var/audit path.
So, Is there anyway to stop... (2 Replies)
Discussion started by: Anti_Evil
2 Replies
LEARN ABOUT DEBIAN
auditd
AUDITD(8) System Administration Utilities AUDITD(8)NAME
auditd - The Linux Audit daemon
SYNOPSIS
auditd [-f] [-l] [-n] [-s disable|enable|nochange]
DESCRIPTION
auditd is the userspace component to the Linux Auditing System. It's responsible for writing audit records to the disk. Viewing the logs is
done with the ausearch or aureport utilities. Configuring the audit rules is done with the auditctl utility. During startup, the rules in
/etc/audit/audit.rules are read by auditctl. The audit daemon itself has some configuration options that the admin may wish to customize.
They are found in the auditd.conf file.
OPTIONS -f leave the audit daemon in the foreground for debugging. Messages also go to stderr rather than the audit log.
-l allow the audit daemon to follow symlinks for config files.
-n no fork. This is useful for running off of inittab
-s=ENABLE_STATE
specify when starting if auditd should change the current value for the kernel enabled flag. Valid values for ENABLE_STATE are "dis-
able", "enable" or "nochange". The default is to enable (and disable when auditd terminates). The value of the enabled flag may be
changed during the lifetime of auditd using 'auditctl -e'.
SIGNALS
SIGHUP causes auditd to reconfigure. This means that auditd re-reads the configuration file. If there are no syntax errors, it will proceed
to implement the requested changes. If the reconfigure is successful, a DAEMON_CONFIG event is recorded in the logs. If not success-
ful, error handling is controlled by space_left_action, admin_space_left_action, disk_full_action, and disk_error_action parameters
in auditd.conf.
SIGTERM
caused auditd to discontinue processing audit events, write a shutdown audit event, and exit.
SIGUSR1
causes auditd to immediately rotate the logs. It will consult the max_log_size_action to see if it should keep the logs or not.
SIGUSR2
causes auditd to attemp to resume logging. This is usually used after logging has been suspended.
FILES
/etc/audit/auditd.conf - configuration file for audit daemon
/etc/audit/audit.rules - audit rules to be loaded at startup
NOTES
A boot param of audit=1 should be added to ensure that all processes that run before the audit daemon starts is marked as auditable by the
kernel. Not doing that will make a few processes impossible to properly audit.
The audit daemon can receive audit events from other audit daemons via the audisp-remote audispd plugin. The audit daemon may be linked
with tcp_wrappers to control which machines can connect. If this is the case, you can add an entry to hosts.allow and deny.
SEE ALSO auditd.conf(5), audispd(8), ausearch(8), aureport(8), auditctl(8), audit.rules(7).
AUTHOR
Steve Grubb
Red Hat Sept 2007 AUDITD(8)