Login or Register to Ask a Question and Join Our Community


Solaris

Connection Logging in Solaris 10 & 11 - Beginner

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Operating Systems Solaris Connection Logging in Solaris 10 & 11 - Beginner
# 8  
Old 09-16-2019
You do not need auditing.
All system access should go through PAM. The standard PAM logging is already a (wrong) comment in /etc/syslog.conf:
Activated it looks like this:
Code:
auth.info                       ifdef(`LOGHOST', /var/log/authlog, @loghost)

Caution, the big space consists of TABs!

kill -HUP or reload/restart the syslogd.

It makes sense to add a rotation to /etc/logadm.conf, for example:
Code:
authlog -C 4 -a 'pkill -HUP syslogd' /var/log/authlog

Being in /etc/logadm.conf - I recommend to also rotate wtmpx (for the last command):
Code:
/var/adm/wtmpx -C 12 -c -p 1m -s 10m

This User Gave Thanks to MadeInGermany For This Post:
FamousAv8er
# 9  
Old 09-17-2019
Hi,

In it's simplest form the information that you require should be available from the last command, an example of the output would be;

Code:
farrells  sshd         10.148.36.183    Fri Sep  6 17:00 - 17:10  (00:09)
farrells  sshd         fbakirmflwd3.eur Fri Sep  6 16:59 - 16:59  (00:00)
farrells  sshd         fbakirmflwd3.eur Fri Sep  6 16:59 - 16:59  (00:00)
mccready  pts/139      10.148.36.190    Fri Sep  6 14:59 - 15:08  (00:09)
mccready  sshd         10.148.36.190    Fri Sep  6 14:59 - 15:08  (00:09)
e421669   pts/202      10.150.134.161   Fri Sep  6 13:28 - 17:27  (03:59)
e421669   sshd         10.150.134.161   Fri Sep  6 13:28 - 17:27  (03:59)
mccready  pts/189      10.148.36.190    Fri Sep  6 12:33 - 12:47  (00:13)
mccready  sshd         10.148.36.190    Fri Sep  6 12:33 - 12:47  (00:13)
mccready  pts/152      10.148.36.190    Fri Sep  6 11:03 - 11:09  (00:06)
mccready  sshd         10.148.36.190    Fri Sep  6 11:03 - 11:09  (00:06)
farrells  pts/76       10.148.36.183    Fri Sep  6 10:55 - 18:12  (07:17)
farrells  sshd         10.148.36.183    Fri Sep  6 10:55 - 18:12  (07:17)
farrells  pts/124      10.148.36.183    Fri Sep  6 09:43 - 18:12  (08:29)
farrells  sshd         10.148.36.183    Fri Sep  6 09:43 - 18:12  (08:29)
oracle    sshd         cathvs-dbadev    Fri Sep  6 07:04 - 07:06  (00:02)
oracle    sshd         cathvs-dbadev    Fri Sep  6 07:04 - 07:04  (00:00)

wtmp begins Fri Sep  6 07:04

You will notice a combination of hostnames and IP Addresses, this is dependent on how the DNS is configured.

Depending on how your logging is setup, you may have to filter the output as there can be more data than you require captured.

Some configuration of the services can be done using inetd and inetadm should you require more details on this then using the man utility is probably where to start.

It should be noted that these files can be very large and any operations on the files can take a significant time, particulary when searching through them and extracting data. The availability of the data may also be limited due to the log rotation policy.

Regards

Gull04
This User Gave Thanks to gull04 For This Post:
FamousAv8er
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Solaris

Sol10 + OpenLDAP = excessive logging & full file system??!!

Hello all, new to this forum (member of many others). Hopefully I can find help here. SERVER: Brand new server Oracle Enterprise SPARC T4-1 Loaded Solaris SPARC 10 u10, patched to 147440-27 Loaded OpenLDAP v2.4.30 Loaded Berkley DB 4.7.25.NC Loaded OpenSSL 1.0.1c Note: All packages are... (2 Replies)
Discussion started by: Wraith_G2IC
2 Replies

2. Shell Programming and Scripting

[Beginner's questions] Filename Validation & Parsing

Hi !! I'm rather new both to the UNIX and scripting worlds, and I'm learning the ropes of scripting. Having said this, please excuse me if you notice certain basic errors. I'm working on a script that implements .jar and .war files for a WAS environment and I need to perform certain... (4 Replies)
Discussion started by: levaldez
4 Replies

3. Solaris

Solaris 10 Not Logging Anything

Hello, It would appear that my server is no longer logging anything. Last time anything was written to /var/adm/messages and /var/log/syslog was Aug 26 2010. I was told there was a storm and the power went out or something around that time, but there were never any problems. I've tried... (11 Replies)
Discussion started by: gadonj18
11 Replies

4. Shell Programming and Scripting

Beginner: Count & Sort Using Array's

Hi, I'm new to linux & bash so please forgive my ignorance, just wondering if anyone can help. I have a file (mainfile.txt) with comma deliminated values, like so: $1 $2 $3 613212, 36, 57 613212, 36, 10 613212, 36, 10 677774, 36, 57 619900, 10, 10 i need to split this file... (12 Replies)
Discussion started by: BigTOE
12 Replies

5. UNIX for Advanced & Expert Users

Disable connection logging for a specfic service (/var/log/secure)

Hello, is there a way to disable connection logging for a specific service? Or eventually to disable /var/log/secure in general? (2 Replies)
Discussion started by: TehOne
2 Replies

6. Linux

Disable connection logging for a specfic service (/var/log/secure)

Hello, is there a way to disable connection logging for a specific service? Or eventually to disable /var/log/secure in general? Closed. Double post (0 Replies)
Discussion started by: TehOne
0 Replies

7. Solaris

Solaris 10 ftp connection problem (connection refused, connection timed out)

Hi everyone, I am hoping anyone of you could help me in this weird problem we have in 1 of our Solaris 10 servers. Lately, we have been having some ftp problems in this server. Though it can ping any server within the network, it seems that it can only ftp to a select few. For most servers, the... (4 Replies)
Discussion started by: labdakos
4 Replies

8. Solaris

RBAC & Logging

I'm trying to set up RBAC, and I need to know where the logs for RBAC are. I'm using Solaris 10 as my OS. I've been reading a lot of documents online and just can't seem to find where the related logs are. My problem is I need to be able to track a user when they su to a role profile, and... (2 Replies)
Discussion started by: bitlord
2 Replies

9. Solaris

Beginner in NYC Needs F2F Solaris Install on Intel64

As a beginner, I am having an impossible time trying to correctly install Solaris 10 on Intel64. Might there be someone in NYC with whom i can F2F install? (1 Reply)
Discussion started by: nweissma
1 Replies

10. UNIX for Dummies Questions & Answers

Solaris & XP connection

Hi, Ok so I'm a new to Solaris (& networking) too, I have an ultra 5 and a network card weith a cross over cable going into my network card on my xp machine that has fatband going into it. I want to utlimately get the two machines talking, I have the IP address of the XP machine but am not... (1 Reply)
Discussion started by: AlanB
1 Replies
Login or Register to Ask a Question