https://community.hpe.com/t5/operating-system-hp-ux/trusted-system/m-p/3449420#M208573 Hi<BR /><BR />pc02 : from where the attempt made for telnet.<BR /><BR />you can also have a look in below url.<BR /><A href="http://seclists.org/lists/bugtraq/1995/Nov/0003.html" target="_blank">http://seclists.org/lists/bugtraq/1995/Nov/0003.html</A><BR /><BR />suresh Tue, 01 Feb 2005 03:30:23 GMT SureshKumar_2 2005-02-01T03:30:23Z https://community.hpe.com/t5/operating-system-hp-ux/trusted-system/m-p/3449418#M208571 As below message, enable the system call: execve and event:login, while I try to telnet it using guest, the audit log shows below.<BR /><BR />My question is why the root displays in the User=root. and what's the meaning of "login, -h, pc02, -p"<BR /><BR /><BR /><BR />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<BR />041223 13:27:45 22893 S 59 3785 00 0 00 ?????<BR />[ Event=execve; User=root; Real Grp=root; Eff.Grp=root; ]<BR /><BR />RETURN_VALUE 1 = 0;<BR />PARAM #1 (file path) = 0 (cnode);<BR />0x40000003 (dev);<BR />1714 (inode);<BR /> (path) = /etc/opt/resmon/lbin/registrar<BR />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<BR />041223 13:27:45 22894 S 59 3785 0 0 0 0 0 ?????<BR />[ Event=execve; User=root; Real Grp=root; Eff.Grp=root; ]<BR /><BR /> RETURN_VALUE 1 = 0;<BR /> PARAM #1 (file path) = 0 (cnode);<BR /> 0x40000007 (dev);<BR /> 28932 (inode);<BR /> (path) = /usr/lbin/telnetd<BR /> PARAM #2 (string array)<BR /> telnetd<BR />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<BR />041223 13:27:45 22895 S 59 22894 0 0 0 0 0 pts/tw<BR />[ Event=execve; User=root; Real Grp=root; Eff.Grp=root; ]<BR /><BR /> RETURN_VALUE 1 = 0;<BR /> PARAM #1 (file path) = 0 (cnode);<BR /> 0x40000007 (dev);<BR /> 2522 (inode);<BR /> (path) = /usr/bin/login<BR /> PARAM #2 (string array)<BR /> login, -h, pc02, -p<BR />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<BR />041223 13:27:51 22895 S 9218 22894 0 0 0 0 0 pts/tw<BR />[ Event=login; User=root; Real Grp=root; Eff.Grp=root; ]<BR /><BR />SELF-AUDITING TEXT: User= guest uid=11113 audid=201 Login successfully<BR />~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~<BR />041223 13:27:51 22895 S 9218 22894 201 0 0 0 0 pts/tw<BR />[ Event=login; User=guest; Real Grp=root; Eff.Grp=root; ]<BR /><BR />SELF-AUDITING TEXT: User= guest uid=11113 audid=201 Successful login Thu, 23 Dec 2004 01:41:20 GMT https://community.hpe.com/t5/operating-system-hp-ux/trusted-system/m-p/3449418#M208571 j773303 2004-12-23T01:41:20Z https://community.hpe.com/t5/operating-system-hp-ux/trusted-system/m-p/3449419#M208572 Is your computer named pc02 or you login from pc02 to the server ? Mon, 31 Jan 2005 22:18:57 GMT https://community.hpe.com/t5/operating-system-hp-ux/trusted-system/m-p/3449419#M208572 Matthew_50 2005-01-31T22:18:57Z https://community.hpe.com/t5/operating-system-hp-ux/trusted-system/m-p/3449420#M208573 Hi<BR /><BR />pc02 : from where the attempt made for telnet.<BR /><BR />you can also have a look in below url.<BR /><A href="http://seclists.org/lists/bugtraq/1995/Nov/0003.html" target="_blank">http://seclists.org/lists/bugtraq/1995/Nov/0003.html</A><BR /><BR />suresh Tue, 01 Feb 2005 03:30:23 GMT https://community.hpe.com/t5/operating-system-hp-ux/trusted-system/m-p/3449420#M208573 SureshKumar_2 2005-02-01T03:30:23Z