topic Re: Audit trail enabling in Operating System - HP-UX

Audit trail enabling

mehul_3 — Fri, 29 Jul 2005 06:13:42 GMT

Hi there!
As per our latest security policy complied in our company, I need to implement Audit trail enable in HP-UX11i server.
Is there any implications like performance killer,rapid log generation etc if the same is ON?

Pl, required immediate help in this regard.
Thanks in advance

Regards,
Mehul

Re: Audit trail enabling

Bill Costigan — Fri, 29 Jul 2005 11:56:24 GMT

You have to be careful of what events you log. We took the default that the log files filled in no time.

Of couse the auditing companies never say what should be logged, just you need to log stuff.

We had to disable the calls to 'semop'
I'd log the least you can to pass the audit.

Re: Audit trail enabling

generic_1 — Fri, 29 Jul 2005 12:35:26 GMT

Make sure you dont log to / or /var
You dont want to fill these up. Be sure you have some generaous space. Turn off as much stuff as allowed. If you turn this thing on fully you will glutin an average default size filesystem in no time :). It will take some resources. Look at the tools in glanceplus, to see how your system is doing healthwise.