topic Enable Auditing On HP-UX in Operating System - HP-UX

Enable Auditing On HP-UX

Ramasubramanian Krishna — Tue, 02 Nov 2010 05:14:35 GMT

I need to enable auditing on HP-UX system and the audit files to be generated on central server.

Re: Enable Auditing On HP-UX

Shibin_2 — Tue, 02 Nov 2010 05:28:21 GMT

Use audsys command to start / stop auditing on your system.

Read man audsys for more information.

I am not sure, whether you can keep it in a remote server.

/.secure/etc/audnames File contains the current and next audit file names and their switch sizes.

Re: Enable Auditing On HP-UX

Shibin_2 — Tue, 02 Nov 2010 05:38:12 GMT

Additionally, read this thread.

http://forums11.itrc.hp.com/service/forums/questionanswer.do?admit=109447626+1288679848061+28353475&threadId=815962

Re: Enable Auditing On HP-UX

Hakki Aydin Ucar — Tue, 02 Nov 2010 12:57:41 GMT

You need to go to SAM > Security > Audit Events

But you need to convert your system Trusted Systems.

And you need to start by Turn Auditing ON from Actions menu.

And remember/be careful, it means too much logs under /.secure/etc

Re: Enable Auditing On HP-UX

Ramasubramanian Krishna — Wed, 03 Nov 2010 06:24:26 GMT

thanks. But I need the audit files created to be on the central server.

Re: Enable Auditing On HP-UX

Sundar G — Wed, 03 Nov 2010 09:33:08 GMT

Ram,

Try exploring the use of syslog-ng which sends all logs to a centralised server (including syslog). It is bundled with DASU tools in HP UX 11.31 . This link may be helpful.

http://forums11.itrc.hp.com/service/forums/questionanswer.do?admit=109447626+1288780164926+28353475&threadId=1179562

-- Sundar

Re: Enable Auditing On HP-UX

Dennis Handly — Wed, 03 Nov 2010 09:42:29 GMT

>I need the audit files created to be on the central server.

Is NFS available to do this?

Re: Enable Auditing On HP-UX

Court Campbell — Wed, 03 Nov 2010 19:58:37 GMT

I agree with Dennis. You will probably need to go the NFS route. Alternatively, you could write a script that changed the log file, and copied the log file off to another server. I did this at my last company. We switched out the audit file via a cronjob and sent it to a management server.

A couple of notes:

1. Make sure the audit info is useful. I cannot tell you how much crap info you can get from auditing. Do you really need to know every semop call?

2. Make sure you have a good amount of space for the logs. If the system cannot write to the audit files, your system will grind to a halt.

Re: Enable Auditing On HP-UX

Ismail Azad — Tue, 09 Nov 2010 19:27:53 GMT

Just one thing, if u are doing via command line. Check the control variable in /etc/rc.config.d/auditing it will typically be 0 so make it as 1.

Re: Enable Auditing On HP-UX

Shibin_2 — Sun, 14 Nov 2010 23:50:37 GMT

I have assigned points to 1 of 13 responses to my questions.

Please assign some points.