Solaris

Hi all,
I'm currently engaged for the first time with solaris audit.
There is the need to monitor action on files in specific directories which is something i was unable to find and documentation for.
Can anyone offer any suggestions or workarounds?

Thanx a lot

That is not possible (per file or directory).

But it is possible to have auditing on for files (f[rwdc] classes) for specific user and using auditreduce extract the information then parse with grep/awk/perl to extract the specific information into plaintext file.

This can be done, of course, from cron or at.

Thanks for the quick reply,
I was thinking as an alternative to monitor the files opened by applications (you need to run a process to deal with a file right?) using the ex class together with argv.
Does it sound reasonable ?

ex class will monitor exec and execve system calls and audit those.

Be careful if your apps are running as root (which they should not), since auditing every root exec or execve call will generate alot of logs.

Other then that argv will also audit everything that is passed to program as an argument.

Sounds reasonable if that is what you want to audit and it is ran by user not root.

Of course, test it, don't deploy auditing on production system before careful testing on test systems. Experiment with various classes to achive the needed results, then go forward.

If deployed wrong, it can halt your system if, for instance, there is no space left for audit logs (if configured like that).

Handle with care

Thanks again, but what if the files are opened by a deamon, ie httpd forking to load an html, will ex catch them too?

Yes it should.

Take a look at this :
Fork-exec - Wikipedia, the free encyclopedia

Best way is to test it to make sure.

Regards
Peasant.

Tracing execs and examining arg lists will not capture interactive file editing. For example:

Code:

vi unaudited_file
:e audited_file

Tracing file accesses (as Peasant suggested in post#2 in this thread) would enable you to find out who accessed (or modified) audited_file; tracing execs and arg lists will not see that audited_file was referenced.