Ignore some Audit log

[Kitti Thanapuasuwan]

I have schedule job from other system to FTP files from AlphaServer every 10 minutes. There is a Security log appear on Console

Security alarm (SECURITY) and security audit (SECURITY) on ALPHA1,
system
id: 1
Auditable event: Network login
Event time: 27-SEP-2004 06:01:35.02
PID: 2142AC6C
Process name: TCPIP$FTPC03E74
Username: TPZKXT
Process owner: [TPOPS]
Image name: DSA0:[SYS0.SYSCOMMON.][SYSEXE]LOGINOUT.EXE
Remote node id: 3237938662 (1.486)
Remote node fullname: 192.255.5.230
Remote username: FTP_C0FF05E6

I would like to un-log this kind of security because it create a lot of message in the log file. Is there any way to skip this security log?

Thanks

[Volker Halle · Accepted solution]

Kitti,

$ SET AUDIT/ALARM/DISABLE=LOGIN=NETWORK

You can find help for enabling/disabling the various audit alarms with:

$ HELP SET AUDIT/ENABLE

Volker.

[Bojan Nemec]

Kitti,

The only thing that comes me in mind now is to disable network alarms and audits. This will disable all network alarms and audits (telnet,rsh,rcp and so on)! So you must look if this is a security issue for you!

You disable the alarms with the command:

$ SET AUDIT/DISABLE=LOGIN=NETWORK/ALARM

and audit with

$ SET AUDIT/DISABLE=LOGIN=NETWORK/AUDIT

But once more: Check if this is not a security issue for yours system.

Bojan

[Jan van den Ende]

Kitti,

to take Bojans answer one step further: you can also disable ONLY succesful logins, (and I guess and sure hope THAT will be the bulk!), and so still get the failures reported.
If you are (have to be) REALLY security aware, well, the failures can do little damage.
But, since the amount of successful login messages is your problem, I assume you are not tracking the validity of those anyway.

My guess: disabling Successfull Login Alarms will take away > 90% of your network login messages, and that IS a big win for starting!.

Success,

Cheers.

Have one on me.

Jan

[Ian Miller.]

note that login failures and logins are seperately specified to auditing. So the commands given will disable audit of net login.

SET AUDIT/AUDIT/ENA=LOGFAILURE=NET

will enable login failure audit of network jobs.

Note also accounting will have records for the network jobs created by the ftp transfers.

[Jan van den Ende]

Kitti,

from your profile:

I have assigned points to 23 of 67 responses to my questions.

... maybe deserves some attention?

If you forgot what questions, just select your own name, that gets you to your profile, from which you can choose "questions with unassigned points"
... and if you consider a thread satidfied, then you can Close it.


Cheers

Have one on me

Jan

[Mobeen_1]

Kitti,
As others before me have mentioned i am not sure if this is wisest thing to do, but the following command could be used to disable

SET AUDIT/AUDIT/ENA=LOGFAILURE=NET

details as follows

SET

AUDIT

/AUDIT

Makes the command apply to audits,
which are messages recorded in
the system security audit log file.
(As suggested by Ian)

If you want to disable the NETWORK class all together, follow the suggestions posted before Ian

regards
Mobeen