topic Re: How do you turn on auditing? in Operating System - Linux

How do you turn on auditing?

Richard Munn — Tue, 14 Dec 2004 22:08:51 GMT

I am running RHEL3 kernel 2.4.21-15 and I want to turning auditing on. Have installed laus but if I try to start auditd with /etc/init.d/audit all I get is (kernel audit support unavailable).

The problem is I can't find anything anywhere which talks about putting audit support in the kernel. So how is it done???

Re: How do you turn on auditing?

Vitaly Karasik_1 — Wed, 15 Dec 2004 03:59:45 GMT

see Release Notes http://www.redhat.com/docs/manuals/enterprise/RHEL-3-Manual/release-notes/as-x86/RELEASE-NOTES-U3-x86-en.html

As far as I understand, "audit" kernel module should run; your can tune audit system by playing with /proc/sys/dev/audit settings.

Rgds,
Vitaly

Re: How do you turn on auditing?

Chris Xu — Wed, 15 Dec 2004 10:44:38 GMT

At your current system, type "lsmod |grep audit" to verify if audit is available. If not, you need to upgrade to RHEL 3.3, which has a newer kernel 2.4.21-20. That version has the audit support built in the kernel. I have a few 3.3 systems with audit running.

Chris

Re: How do you turn on auditing?

HGN — Wed, 15 Dec 2004 11:52:39 GMT

Hi

This is available with later kernel 2.4.21.34 has this on our servers.

Rgds

HGN

Re: How do you turn on auditing?

Richard Munn — Wed, 15 Dec 2004 16:03:34 GMT

An upgrade to 2.4.21-20 seems to have done the trick. Thanks!