Solaris Auditing: Newly specified events not being logged
Hi all
I'm busy testing auditing on Solaris 10.
I am using the syslog plugin to get real time view of what's happening on the system. Initially I am only monitoring lo events. The audit_control file looked like this:
I then wanted to add the the class, fd, as well. I did this as follows:
I ran the command to reread the audit_control file:
Also just, in case, I restarted the box using
I am however not seeing file delete events being tracked when I test it.
Is there something I am doing wrong? The documentation I have found is not helping me much in this regard.
Whilst I do use Solaris auditing on all my boxes, I don't currently have access to my test system to try out the syslog plugin. A few thoughts:
1. Are you seeing the lo events in the syslog feed?
2. Are you able to see the fd events if you configure audit to write them to file?
3. All the documentation* examples for the syslog plugin show p_flags entries as preceeded by either a "+" or "-" - perhaps try adding these?
Hello,
Im glad to become a member of this forums,
Im new on solaris and recentrly im introducing to use auditing service in that system.
The need is, that I need how to exclude a directory to the audit service not audit it.
And, a plus, I need of how to disable auditing the root user in... (0 Replies)
Dear Solaris 11 experts,
I can not logon to a newly installed Solaris 5.11 11.2 i86pc i386 i86pc just downloaded today, despite having entered username and password to be created. However, I cannot get on to this workstation after Solaris installation completion. Can you advice how to reset my... (5 Replies)
We are having a problem with initializing Solaris 8 installed on a Sunblade 1500 after having cloned the hard disc.
(The cloning process was done in a windows environment. Not a UNIX environment.)
Immediately after the cloning process neither hard disc would boot until the format label... (10 Replies)
Hi folks,
How can I scan newly attached network interfaces to server without reboot?
Is there any command or something to scan without reboot.
Thanks (5 Replies)
Hello experts,
This issue has kept me busy all day long. It started off with openssl compilation which was giving linking error with following message:
/usr/local/bin/ld: target elf32-sparc not found
collect2: ld returned 1 exit status
I tried every step possible thing that I could think... (2 Replies)
Hello,
I was wondering when Solaris auditing is enabled, If it is possible to keep track of users that are allowed to sudo to root. In other words, I would like to know which user did what on my Solaris box. (assumig that user can "sudo su -" )
Thanks. (2 Replies)
Hi All,
I have a requirement to report us on changing a group of static files.
Those are the binary files that run in Production every day.
Due to the in sercure environment situations, I found many are indulging in there own changes to the binaries by doing some changes in the souce code.
... (1 Reply)
Hi there,
I want to enable auditing for the following events in a critical AIX UNIX server by editing the /etc/syslog.conf file:
Authentication events (login success, login failure, logout)
Privilege use events (change to another user etc.) ... (1 Reply)
Hi Guys,
I am new to this forum so I am sorry if i posted this thread in the wrong place. I am currently trying to get BSM to work on solaris 10 by Logging few things for me. I need your help to complete this task please.
this is the config of the audit files:
audit_conto
# Copyright... (18 Replies)