topic Re: Auditing has moved in Redhat V4 in Operating System - Linux

Auditing has moved in Redhat V4

Robert Walker_8 — Tue, 19 Jul 2005 18:33:25 GMT

Hi,

Have been trying to set up a system configuration - which will use Auditing. We worked out in V3 etc that we could implement auditing and use aucat to get details from the Audit subsystem. We also we caught on the fact that auditing was generating 20mb a day audit logs and filling up var.

However, moving to RHEL4 aucat and audit are gone - replaced by auditctl and of course SELinux. Anyone got some details on this.

Would much appreciate.

Rob.

Re: Auditing has moved in Redhat V4

Steven E. Protter — Wed, 20 Jul 2005 07:42:55 GMT

They kind of pulled support and went to a different product on you, without adequate notice.

SELINUX will prevent you if active from doing things like having a httpd server thats no based in the /var filesystem. I generally turn it off or put it into warning mode on my RH/Centos boxes.

You are kind of stuck, probably needing to learn this new product which will probably have some similarities to the old product.

Re: Auditing has moved in Redhat V4

Robert Walker_8 — Fri, 22 Jul 2005 00:09:25 GMT

Thanks,

Ok now what do most Linux sys admins do about tracking what happened where when who and how.

Under T64 and OpenVMS you can track down to whoes opening files etc.

This used to exist in V3 U4 but as I mentioned it has now gone?

Robert.