topic Re: Send audit logging to syslog for centralized syslog server in Operating System - HP-UX

Send audit logging to syslog for centralized syslog server

Paul Maglinger — Tue, 07 Dec 2010 20:10:10 GMT

Running HP-UX 11.23. I'm wanting to send the auditing information to the syslog so it will go to our centralized syslog server. Because this additional logging has the potential to create big log files, I don't need or want them to be on the local system. I have been successful in getting the syslogs to go to the centralized syslog server by adding the following line in the syslog.conf file:
*.info @
I have tried using #audsys | logger and that doesn't seem to be working. Can anyone offer me some insight?

Re: Send audit logging to syslog for centralized syslog server

Shibin_2 — Wed, 08 Dec 2010 03:05:54 GMT

I hope, this thread will be helpful to read.

http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=1454565

Re: Send audit logging to syslog for centralized syslog server

Paul Maglinger — Wed, 08 Dec 2010 17:51:31 GMT

I don't believe this will work. This is on a system running NIS for authentication and therefore isn't trusted. The workaround I used was to installed enhanced security, which then allowed me to run auditing. I just can't get the auditing to go to the syslog. I tried installing syslog-ng, but I can't run the GUI on 11.23. The reference manual was too vague for me to be able to use. I do not wish to tail because I'd like it to be logged in real time. Putting it in cron would cause it to be batched, would it not? Any other thoughts from anyone?

Re: Send audit logging to syslog for centralized syslog server

Paul Maglinger — Wed, 08 Dec 2010 22:48:26 GMT

I have gone to another system that is not using NIS and implemented auditing. I have told it to audit create, delete, chmod, etc.

After which I did created a file using touch, chmod, chgrp, vi'ed the file, and then deleted it. Shouldn't I have been able to see these changes in the auditlog? And shouldn't it show the file that was created/changed/removed?

Re: Send audit logging to syslog for centralized syslog server

Paul Maglinger — Thu, 16 Dec 2010 22:53:19 GMT

I'm going back to square one. Can anyone tell me how to direct the auditing results either in addition to or just directly to the syslog?

Re: Send audit logging to syslog for centralized syslog server

Bill Hassell — Fri, 17 Dec 2010 00:03:43 GMT

Assuming that auditing uses the auth facility, you can direct just the auth entries to your syslog server like this:

auth.info @

To keep the auth records from showing up in syslog.log, add: auth.none to the syslog.log entry like this:

*.info;mail.none;auth.none /var/adm/syslog/syslog.log
auth.info @

NOTE: NO SPACES! Every space in the syslog.conf file causes the entire to be silently ignored. Use TAB to separate elements.

However, it appears (man audsys) that audsys never uses syslog because the log can grow VERY fast (dozens of MB in minutes). Conversely, the default location for audsys logs is /, the dumbest place for log files. So you can script an audsys logfile scanner (tail will never work because the logfiles are switched regularly). The scanner would find the newest file, then use logger to extract the last record as well as determine (with wc) the file size. Then every few seconds, check the file size and grab all new records and send them using logger. The script will also have to monitor the audsys logfile switch. Not elegant, but that's the way audsys works.

NOTE: audsys can generate massively large logs and therefore massive network traffic when configured inappropriately.

Re: Send audit logging to syslog for centralized syslog server

Paul Maglinger — Tue, 01 Feb 2011 15:50:14 GMT

HP-UX auditing sure seems to be lacking in many respects. The output from audisp is cryptic at best. I can't see where it specifically shows that a file has been modified, a feature that would seem to be key to any auditing. If anyone knows of a better solution, I like to hear about it.