topic Auditing in Operating System - HP-UX

Auditing

Angela L. Shepherd_1 — Tue, 13 Feb 2001 17:24:52 GMT

I can't get auditing to work on one of my systems. When I go into sam (select auditing and security and then audited events) I receive the following error message:

The attempt to modify the auditing configuration using audsys failed. The command return value was "-1" and the standard error output was: warning: cannot read badly formatted /.secure/etc/audnames current audit file /audsys/audsys/af.start1 insufficient space available on audit file filesystem, specify a different audit file of select a smaller AFS auditing system unchanged.

I can't remember how to specify a different audit file from the command line.

Re: Auditing

Steven Sim Kok Leong — Tue, 13 Feb 2001 17:31:42 GMT

Hi,

# audsys -c pathname-of-new-audit-file -s size-in-kbytes

Hope this helps. Regards.

Steven Sim Kok Leong
Brainbench MVP for Unix Admin
http://www.brainbench.com

Re: Auditing

Jason VanDerMark — Tue, 13 Feb 2001 17:33:21 GMT

You could use

audsys -n -c auditlog.new

This should start auditing and set the current file(the one that all audit records are set in) to auditlog.new. It is best to set the current file to one that doesn't exist or to one that is empty. Hope this is what you were looking for. For more info check out the manpages on audit or audsys or any of the other audit commands.

Good Luck,
Jason V.

Re: Auditing

Madhu Sudhan_1 — Tue, 13 Feb 2001 17:39:04 GMT

Hi Angela !

You can use

#audsys -n -c -s -x -z

"-n" stands for turning on the audit system and "-f" for turning off.

...Madhu

Re: Auditing

Angela L. Shepherd_1 — Tue, 13 Feb 2001 18:06:55 GMT

I don't have a /.secure/etc/audnames file.

Re: Auditing

Madhu Sudhan_1 — Tue, 13 Feb 2001 20:35:38 GMT

Hi Angela !
Looks to me like the "audnames" file is corrupted or not there. Turn off the auditing by using audsys and "-f" option and restore audnames file from the backup if you have backedup.

or

try

#touch /.secure/etc/audnames (to create an empty file)

and then turn on the auditing and the audit users and audit events. Ilooked for the format of audnames and couldn't find.

Hope this helps.
...Madhu