Settings audit logs for different tasks. Help me!!!


Login or Register for Dates, Times and to Reply

 
Thread Tools Search this Thread
# 1  
Settings audit logs for different tasks. Help me!!!

Hi guys.

I have to set audit logs on certain events on a solaris 10 server.

While I had no problems on linux, I'm going crazy to do the same thing on solaris 10, since I don't have enough expertise on this OS .

I should be able to identify these 4 different events:



1: Tracking all the activities performed by root account

2: Tracking all privilege escalation performed by sudo or su command

3: Tracking all account removal/add in the system

4: Detects system time changes which are not done by a local service or a service account.



Can you give me a hand? Thanks a lot to everyone!
# 2  
Welcome on board!

What makes you think it is that different in Solaris?
If you can do your tasks in linux, then show us what you do in linux, we will help you do the same on solaris...
E.g.
1: Tracking all the activities performed by root account, how do you do that in linux?
- Why cant you do the same in solaris? The only reason I see is perhaps because no one is using root account and use sudo or a RBAC...
# 3  
In my linux boxes i used the "auditd" tool with this settings in the "audit.rules" file:

Quote:
# Enable the logging

-e 1

# Time
-a always,exit -S adjtimex -S settimeofday -S clock_settime -F euid!=ID_NTP_USER -k time-change

#User Mod
-w /usr/sbin/useradd -p x -k user-modification
-w /usr/sbin/usermod -p x -k user-modification
-w /usr/sbin/adduser -p x -k user-modification
-w /usr/sbin/userdel -p x -k user-modification

# Priv-esc
-w /bin/su -p x -k priv-esc
-w /usr/bin/sudo -p x -k priv-esc

# Log All Root Command
-a exit,always -F arch=b64 -S execve -F euid=0 -k root-command
-a exit,always -F arch=b32 -S execve -F euid=0 -k root-command
Is there a way in solaris to achieve the same config?

Thank u!
Login or Register for Dates, Times and to Reply

Previous Thread | Next Thread
Thread Tools Search this Thread
Search this Thread:
Advanced Search

Test Your Knowledge in Computers #973
Difficulty: Easy
GCC is the default compiler for the Linux kernel source.
True or False?

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

If I ran perl script again,old logs should move with today date and new logs should generate.

Appreciate help for the below issue. Im using below code.....I dont want to attach the logs when I ran the perl twice...I just want to take backup with today date and generate new logs...What I need to do for the below scirpt.............. 1)if logs exist it should move the logs with extention... (1 Reply)
Discussion started by: Sanjeev G
1 Replies

2. Solaris

How can i enable audit logs for global zone and standard zones?

HI Community, how can i configure audit logs for global zones and standard zone. i have enabled and started auditd service and it went to maintenance mode. please help me to configure that Thanks & Regards, BEn (9 Replies)
Discussion started by: bentech4u
9 Replies

3. Solaris

Configuring 'auditd' service to not store the audit logs in /var partition

Hello all, I've configured 'audit' service to send the audit logs to a remote log server (by using syslog plugin), which is working fine. However, there is a problem. audit service also tries to write same information (but in binary format) in /var/audit path. So, Is there anyway to stop... (2 Replies)
Discussion started by: Anti_Evil
2 Replies

4. Solaris

How to view audit logs in Solaris?

Does anyone know if there is software written to view the audit logs generated by Solaris? I am referring the the logs created by auditd. It produces an unreadable log. I am familiar with auditreduce and praudit, but I am looking for something that produces a report, much like logwatch looks at the... (4 Replies)
Discussion started by: brownwrap
4 Replies

5. Solaris

how to configure a audit in global zone that will audit all the zone

Hi everyone, how i can configure a single audit service in the global zone for all zones, on solaris BSM. I will be glad to hear back from you. Thanks and Regards (3 Replies)
Discussion started by: ladondo
3 Replies

6. Red Hat

Secure & Audit logs

Hi all I am trying to add secure and audit logs to logrotate for a client whom wants the logs for a period of 6 months, compressed/zipped weekly for auditing. I am terrible with logrotate and since there isn't default settings for both logs, I created two new entries in my /etc/logrotate.d/... (7 Replies)
Discussion started by: hedkandi
7 Replies

7. AIX

When AIX audit start, How to set the /audit/stream.out file size ?

Dear All When I start the AIX(6100-06)audit subsystem. the log will save in /audit/stream.out (or /audit/trail), but in default when /audit/stream.out to grow up to 150MB. It will replace the original /audit/stream.out (or /audit/trail). Then the /audit/stream.out become empty and... (2 Replies)
Discussion started by: nnnnnnine
2 Replies

8. Homework & Coursework Questions

Hello.. can someone help my with this tasks?

1. Write a shell program which renames the current directory with the given file extension to another extension. The playoffs are given on the command line. Example usage: $ Rename txt doc will be renamed: aaa.txt in aaa.doc Juhutxt in Juhudoc ... * To solve, you can also help with... (5 Replies)
Discussion started by: eclip
5 Replies

9. Shell Programming and Scripting

Grep yesterday logs from weblogic logs

Hi, I am trying to write a script which would go search and get the info from the logs based on yesterday timestamp and write yesterday logs in new file. The log file format is as follows: """"""""""""""""""""""""""... (3 Replies)
Discussion started by: harish.parker
3 Replies

10. UNIX for Dummies Questions & Answers

Need help with tasks!

Hi guys! I have a dummy question for u :p I cant find a solution for these tascks...tried everything (i know :cool: ). 1 Issue the following command sleep 1000 Note that sleep 1000 waits 1000 seconds!!! You cannot do anything now!!! 2 Open another terminal window and enter the tty... (1 Reply)
Discussion started by: RomeO
1 Replies

Featured Tech Videos