Auditing removed accounts

[Susan Pellerito]

Is there anyplace where a removed or modified user is logged? The auditor is asking for proof of a terminated employees removal from the system within 45 hours. Any ideas?

[James R. Ferguson · Accepted solution]

Hi Susan:

If you use SAM to remove an account, SAM will log the event in '/var/sam/log/samlog'. Use the SAM viewer to examine the file either within SAM or with 'samlog_viewer(1)'.

Regards!

...JRF...

[Steven E. Protter]

Shalom,

Proof that something does not exist huh? Only an auditor or Israeli(I'm just such a nut) could demand such.

Ideas:
1) id username

Idea 1 will show that the user name does not exist. If the command prompt includes the date and time you are good.

2) Log the output of the user removal and split the output with the | tee command. This will create an audit trail.

3) Use trusted system and run a post removal audit report. Note that this has been deprecated in HP-UX 11.31 as an option.

SEP

[Tim Nelson]

If SAM was not used as mentioned.

Then use last to show the last login time, then logins or grep to show username is no longer there.

A future option would be to write a wrapper script that time stamps when userids were removed.

something as simple as the below may work, but certainly falible.

echo "removing username XYZ" >> logfile
userdel -r XYZ

[Susan Pellerito]

Thanks you all for your advice! I have worked out a method to use the samlog_viewer to collect the necessary information.