9 More Discussions You Might Find Interesting
1. Shell Programming and Scripting
Hello all,
I'm trying to update auditd.cron to force rotate daily and gzip audit.log.1. I will probably then remove anything older that 3 months. The part I don't like about my script right now is the sleep command. It seems that the "/sbin/service auditd rotate" command must use a different... (2 Replies)
Discussion started by: cdlaforc
2 Replies
2. UNIX for Dummies Questions & Answers
I'm running CentOS 5.x and want to disable this daemon as it's crashing my server daily!
I didn't install that and don't know why it's started magically for some reason.
Please enlighten me to the answer to this question, I've read the man pages on this and found something that stops it... (2 Replies)
Discussion started by: HiphopTech
2 Replies
3. Cybersecurity
the events done on the serial console does not get logged. I am using BSM audit.
I have enabled all audit flags. Is there anything that im missing?
Please help!! (2 Replies)
Discussion started by: chinchao
2 Replies
4. Linux
Hi All,
could any one point out any open source test-suites for "File cache" testing and as well as performance test suites for the same. Currently my system is up with Linux/ext4.
Regards
Manish (0 Replies)
Discussion started by: hmanish
0 Replies
5. Linux
Hi all
I saw in Microsoft web site www.SysInternals.com a tool called CoreInfo from able to print out on screen the size of the Data and Instruction caches of your processor, the Locigal to Physical Processor mapping, the number of the CPU sockets. etc..
Do you know if in Linux is available a... (2 Replies)
Discussion started by: manustone
2 Replies
6. UNIX for Dummies Questions & Answers
Hi,
I have the following my logs:
Nov 20 04:02:04 mail-07 kernel: audit: audit_backlog=326 > audit_backlog_limit=320
Nov 20 04:02:04 mail-07 kernel: audit: audit_lost=4272 audit_rate_limit=0 audit_backlog_limit=320
Nov 20 04:02:04 mail-07 kernel: audit: backlog limit exceeded
Nov 20... (0 Replies)
Discussion started by: mojoman
0 Replies
7. Red Hat
Has anyone used, or set up auditd?
I want to use it to audit critical system files.
Will this be hard, how would I start setting this up?
:eek: (2 Replies)
Discussion started by: syndex
2 Replies
8. UNIX for Dummies Questions & Answers
I want to disable the auditd daemon on my unix server. Running this daemon on the server causes to system to crash afer every two month. Could any one let me know step by step how to disable it and is there any implication of doing it? (2 Replies)
Discussion started by: skumar11
2 Replies
9. UNIX for Advanced & Expert Users
hi,
What is the difference between UBC cache and Metadata cache ? where can i find UBC cache Hits and Metadata cache Hits in hp-ux?
Advanced thanx for the help. (2 Replies)
Discussion started by: sushaga
2 Replies
audit_binfile(5) Standards, Environments, and Macros audit_binfile(5)
NAME
audit_binfile - generation of Solaris audit logs
SYNOPSIS
/usr/lib/security/audit_binfile.so
DESCRIPTION
The audit_binfile plugin module for Solaris audit, /usr/lib/security/audit_binfile.so, writes binary audit data to files as configured in
audit_control(4); it is the default plugin for the Solaris audit daemon auditd(1M). Its output is described by audit.log(4).
The audit_binfile plugin is loaded by auditd if audit_control contains one or more lines defining audit directories by means of the dir:
specification or if audit_control has a plugin: specification of name=audit_binfile.so.
OBJECT ATTRIBUTES
The p_dir and p_minfree attributes are equivalent to the dir: and minfree: lines described in audit_control. If both the dir: line and the
p_dir attribute are used, the plugin combines all directories into a single list with those specified by means of dir: at the front of the
list. If both the minfree and the p_minfree attributes are given, the p_minfree value is used.
EXAMPLES
The following directives cause audit_binfile.so to be loaded, specify the directories for writing audit logs, and specify the percentage of
required free space per directory.
flags: lo,ad,-fm
naflags: lo,ad
plugin: name=audit_binfile.so;
p_minfree=20;
p_dir=/etc/security/jedgar/eggplant,
/etc/security/jedgar.aux/eggplant,
/etc/security/global/eggplant
ATTRIBUTES
See attributes(5) for a description of the following attributes:
+-----------------------------+-----------------------------+
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
+-----------------------------+-----------------------------+
|MT Level |MT-Safe |
+-----------------------------+-----------------------------+
|Interface Stability |Evolving |
+-----------------------------+-----------------------------+
SEE ALSO
auditd(1M), audit_control(4), syslog.conf(4), attributes(5)
SunOS 5.10 20 May 2003 audit_binfile(5)