AIX

can some give some tips, most common security issues or and kind of advice about auditing aix system?

regards

Can't help you out with particular hints, but in case you do not already know them, there are IBM Redbooks about it (quite old):
IBM Redbooks | Auditing and Accounting on AIX
and
IBM Redbooks | Accounting and Auditing on AIX 5L

Depending on your version of AIX, there is also a Security handbook. Here for AIX 7:
http://publib.boulder.ibm.com/infoce...curity_pdf.pdf

I remember there is one for AIX 6 too.

first of all what you need to know is where is the audit files located.
1) audit configuration files are located in /etc/security/audit
2)destination of audit log /audit (this is the main audit)
### for stream mode ###
1) log file /audit/stream.out
**strongly suggest /audit is mounted as a file system**
##make sure /etc/security/streamcmds contains##

Code:

/usr/sbin/auditstream | auditpr -v > /audit/stream.out &

in /etc/security/audit/config file, select which mode is used at startup
:: streammode = on (for stream mode)

after that running audit by using command

Code:

:: /usr/sbin/audit start

query the configuration by using command

Code:

::/usr/sbin/audit query

shutdown audit by using command

Code:

::/usr/sbin/audit shutdown

example::

Code:

# /usr/sbin/audit shutdown
# sleep 5
# mv /audit/stream.out /audit/audit`date +%m%d`.log
# /usr/sbin/audit start
# fuser -k /audit/audit`date +%m%d`.log