How to capture root activity on HPUX 11.11

[CA1452717]

Hello Genius,

I am novice in the filed of HPUX. Can you please help me to find or configure the system in order to capture each and every move/activity of root or any equivalent user on my HP-UX box.

Many thanks in advance for time and advice.

Regards,
Vaibhav

[Johnson Punniyalingam]

>>>capture root activity on HPUX 11.11

Best approach would be by enabling (Auditing) in your server,

Check below link,
http://forums13.itrc.hp.com/service/forums/questionanswer.do?admit=109447627+1277967664446+28353475&threadId=1331532

[CA1452717]

Many Thanks Johnson. I will try and write back in case if needed.

Regards,
Vaibhav

[Bhadresh]

Hi Vaibhav,

Enable Audit on your server. Have a look at following thread:

http://forums11.itrc.hp.com/service/forums/questionanswer.do?&threadId=1022171

Regards,
Bhadresh

[Deeos]

hi,


you can enable History of your server!



vi /etc/profile

HISTFILE=/.sh_history
exprot HISTFILE
HISTSIZE=100000
export HISTSIZE

or you can add those parameters to root $HOME .profile file!

[Deeos]

mistake,

export HISTFILE

[CA1452717]

Hi Deedos and Bahdresh,

Many thanks for your reply and time. I appreciate it. I shall try your suggestions and let you know the output.

Thanks,

Vaibhav

[Hakki Aydin Ucar]

to use audit you need to have a trusted server ,you can check it by the command :
ls -l /tcb/files/auth/system/default

IF the file
/tcb/files/auth/system/default available then, it is trusted .