topic Re: Trusted Audit Log in Operating System - HP-UX

Trusted Audit Log

Randy Gelineau — Wed, 04 Aug 2004 08:51:14 GMT

When setting the log parameters on a trusted system...how large can the audit file be?

In sam the file cannot be set to a very large value. One command line (audsys) one could set the parameter for size to just about anything. However, not all sizes seem to work.

Is there a size limit to the audit file?

Re: Trusted Audit Log

Steven E. Protter — Wed, 04 Aug 2004 09:24:00 GMT

You set the limit. You set the location.

I'm attachng a script that will be a good example.

SEP

Re: Trusted Audit Log

Muthukumar_5 — Wed, 04 Aug 2004 09:31:22 GMT

audit file informations can be retrieved using audsys or /etc/rc.config.d/auditing file.

audsys configuration details will be forgot after system reboot. Default one is at /etc/rc.config.d/auditing file

Audit file size depends upon the switch over size PRI_SWITCH parameter on auditing file or -s cafs option on audsys

auditing file is as like any normal file can be used to store contents. It is limit as like normal file. To make default setting about auditing use auditing file for that.

To get notification messages about audit log overflow use audmon call for this.

Regards
Muthu

Re: Trusted Audit Log

Randy Gelineau — Wed, 04 Aug 2004 09:31:43 GMT

We are having problems getting the audit file to be a large size (99999k). The file does not fill but trusted mode doesn't seem to like it after a short time.

Re: Trusted Audit Log

Muthukumar_5 — Wed, 04 Aug 2004 10:36:54 GMT

It is good to use the secondary audit file after some limit of storage on primary file.

Or try to use logrotate logic(s) here to trim your logfile(s) everyday status to keep your audit file as healthy one.

Put the script in cron to automate that.

Or change the audsys operation on everyday as,

audsys -n -c -s -x -z

Move the file to your backup (with compression too)

Automate this with script.

NOTE: audsys - can not be effective if you reboot your system. You have to use auditing file

_muthu_