Aix auditing : performance impact

10 More Discussions You Might Find Interesting

1. AIX

Configure AIX server to send logs and auditing to Qradar

Hi All I need your help to configure Aix to send logs to Qradar, I did all the methods that mentioned in IBM website and no use, Plz Help,, The Logs should I receive from Aix and display in Qradar is (create user delete user changing in privileges....etc ) my skype account khaled_ly84 ...

2. AIX

User auditing from AIX server

I am trying to find out the information of my local desktop when i use putty to login to an AIX server. This is what I do: 1. login to my PC 2. take a putty session to an AIX server Can i get information of my local desktop from the AIX server ? Is there a command available ? Thanks

3. AIX

AIX auditing

In our customer place somebody removed and PV from the server. I want the information like which user removed this PV. Is there any way to get PV removal information. When did the PV removed from the server ? Whether AIX auding will help ? Where i can get these information ? Thank...

4. Shell Programming and Scripting

Long PATH, LD_LIBRARY_PATH, LIBPATH, � � what kind of performance impact do they have?

Hi, there! a long PATH... makes the OS access the disk quite often, hence there is a lot of disk I/O a long PATH... makes the OS compute a lot of ..., hence a high CPU load (Edited/added later: Yes, this is not about the lenght of the env. var., but about the number of directories listed.)...

5. UNIX for Advanced & Expert Users

Performance impact of terminal output

Hello, I am doing fluid simulations using OpenFOAM. This program produces a lot of output every time step. Producing output is surely not the most time consuming part, but I wonder whether writing output to the terminal or writing it into a file is faster. With thousands of time steps a...

6. AIX

AIX auditing

can some give some tips, most common security issues or and kind of advice about auditing aix system? regards

7. AIX

Help me! AUDITING AIX

Hi All, i've a problem on a AIX server with audit config... when i start the audit i receive this error: root@****:/etc/security/audit > /usr/sbin/audit start Audit start cleanup: The system call does not exist on this system. ** failed setting kernel audit objects I don't understand...

8. AIX

AIX Auditing problam

i have sucessfully enable the auditing on AIX with adding som onjects. but when i go for auditpr -v < /audit/trail vlets say i reset audit at last dat 5 pm auditpr -v < /audit/trail will show up to last day 5 pm. i have to reset audit every time to check latest logs. please...

9. AIX

AIX auditing

I have a question relating with AIX auditing Question is can we set Auditing on a particular file in AIX for a particular application only? Let say I have a file name "info.jar" and I have three application named APP1, APP2 & APP3 which are accessing that file so I want to know that which...

10. AIX

turning auditing on AIX 4.3

Hi, What's the best way to turn on the auditing in AIX 4.3? I'm in an environment where root password are shared with many users. Can sudoers member be audited properly? Thanks

LEARN ABOUT ULTRIX

auditmask

auditmask(8) System Manager's Manual auditmask(8)

Name
auditmask - get or set auditmasks

Syntax
auditmask [ option ... ] [ event[:succeed:fail]

Description
The command with no arguments displays the system-calls and trusted-events currently being audited for the system, and displays whether
they are being audited under successful or failed occurrences or both. The format used for the display is acceptable as input to the com-
mand.

The command with event arguments sets the system-call and trusted-event audit masks for the system. This is cumulative operation, so it is
possible to turn on or off audit for one set of events, then turn on or off audit for a second set of events without changing the first set
of events (except for intersection between the two sets). Command line arguments to can include one or more events, each with an optional
field :succeed:fail, where succeed is either 0 to specify no auditing of successful occurrences of event, or 1 (or any non-zero character)
to specify auditing of successful occurrences of event; and fail is either 0 to specify no auditing of failed occurrences of event or 1 (or
any non-zero character) to specify auditing of failed occurrences of event. The event name is the system-call name or the trusted-event
name (see audit.h ).

The command will also accept redirected input, which can be the output of a previously issued command. This is a file which contains lines
of the format event [succeed][fail]. If the keyword succeed is present, successful occurrences of that event will be audited; if the key-
word fail is present, failed occurrences of that event will be audited; if both are present, successful and failed occurrences will be
audited; if neither keyword is present, that event will not be audited.

The auditmask command can also be used to set the audit style characteristics of the audit subsystem. These characteristics control how
much information is recorded on exec operations.

The command is used in to initialize the auditmask at boot time according to the file This makes use of privileged operations within the
system call.

Options
-f Turns on full auditing for the system. This list may include events which have no symbolic name and are represented only by a
number (reserved for future use); these events will not be audited, despite their presence in the auditmask.

-n Turns off all auditing for the system.

-s aud_style
An aud_style of "exec_argp" enables the auditing of the argument list to an or syscall. An aud_style of "exec_envp" enables
the auditing of the environment strings to an or syscall.

AIX