topic Re: System call to flush or null a file in Operating System - HP-UX

System call to flush or null a file

coollllllllllll — Wed, 08 May 2013 08:20:35 GMT

Hi ,

What is the system call from unix end to flush or nullify a file.

am thinking of starting auditing of my hpux boxxes 11.23 , wherein some major system calls to be monitored for some users.

like root oracle , application user.

what should i use "audevent -P -s ????" here to catch hold of someone trying to flush a file or flushed a file .

Re: System call to flush or null a file

Dennis Handly — Wed, 08 May 2013 09:54:51 GMT

To catch trying to reset the EOF of a file, you need to look for open with O_TRUNC.

Re: System call to flush or null a file

coollllllllllll — Wed, 08 May 2013 12:42:45 GMT

Hi Dennis ,

Thanks

Also i have observed that "rm " is not getting captured via auditing i.e audevent is there any way i can track it ???

Re: System call to flush or null a file

Dennis Handly — Wed, 08 May 2013 20:03:03 GMT

>I have observed that "rm" is not getting captured

rm is an unlink(2).

Re: System call to flush or null a file

coollllllllllll — Thu, 09 May 2013 10:03:00 GMT

Hi Dennis ,

Can i have auditing enabled only for some specific commands and for some specific users ONLY like ,

rm -rf

someone flushing a file

someone renaming a file

someone copying a file

Re: System call to flush or null a file

Dennis Handly — Tue, 14 May 2013 05:55:46 GMT

>Can I have auditing enabled only for some specific commands?

Only if you log execution of that command. I.e. open that executable.

Or there is a system call that the command does.

I assume if you have auditing turned on, you can filter for specific users.

>someone renaming a file

This is a rename.

>someone copying a file

This is some opening that file.

Re: System call to flush or null a file

coollllllllllll — Tue, 14 May 2013 05:38:00 GMT

Hi Dennis ,

I didnt get it.

Only if you log execution of that command, open that executable.

Or there is a system that the command does.

Re: System call to flush or null a file

Dennis Handly — Tue, 14 May 2013 05:56:39 GMT

>I didn't get it.

I've updated the post and fixed a few missing words.

Re: System call to flush or null a file

chindi — Wed, 17 Jul 2013 08:01:12 GMT

Hi Matti ,

Can you please help me here with your inputs.

Re: System call to flush or null a file

Dennis Handly — Wed, 17 Jul 2013 08:30:30 GMT

>Can you please help me here with your inputs?

What's your question?

Re: System call to flush or null a file

chindi — Wed, 17 Jul 2013 11:04:19 GMT

Can i have auditing enabled only for some specific users ONLY

Able to rotate those log files say after one day ?

Re: System call to flush or null a file

Matti_Kurkela — Wed, 17 Jul 2013 13:55:47 GMT

> Can i have auditing enabled only for some specific users ONLY

Yes. Please see "man audusr" on your system.

> Able to rotate those log files say after one day ?

You should write a script that first uses "audsys -c some_new_file" to switch the audit log to a new file, then your script can do whatever you want with the old audit log file.

Re: System call to flush or null a file

chindi — Thu, 18 Jul 2013 12:05:53 GMT

Hi Matti ,

Am trying the below steps ;

audsys -f

audusr -D

will disable auditing for all users, and then:

audusr -a root -a oracle

will add it back for those users.

then audsys -n -c /mydir/audlog20MB -s 20480

which is creating 20MB file with lots of junk , not able to understand anything.

We are using audisp /mydir/audlog20MB to analyse this logs , but no success .

Can you help us to trace any file removal , flush activity being carried out for a particualr user say oracle .

Re: System call to flush or null a file

Matti_Kurkela — Thu, 18 Jul 2013 13:26:45 GMT

Yes, the audlog20MB will be a binary logfile that can only be read using a tool like audisp.

If you are logging only root and oracle users, then:

audisp -e delete -u oracle /mydir/audlog20MB

should display all file removals done by user "oracle".

Flushing a file is a little bit more tricky, since it is essentially just opening a file for writing, with the O_TRUNC option.

So you would have to run something like:

audisp -e open -u oracle /mydir/audlog20MB

and then use grep or similar to find only the interesting events from the output.

Unfortunately I don't have an example of 11.23 audisp output available to me (my test server is not in Trusted mode and does not have the Standard Mode Security Extensions installed). So I cannot design a suitable filter command for you.

Re: System call to flush or null a file

chindi — Fri, 19 Jul 2013 05:23:38 GMT

Hi Matti ,

I need to keep a record of all suspicios activities carried out in my box.

All commands ran by a user in his/her shell

We are using history variable in /etc/profile .

But as Dennis said we cannot alter history settings .

Do we have any other alternate solution to this auditing problem.