Enable Auditing On HP-UX

[Ramasubramanian Krishna]

I need to enable auditing on HP-UX system and the audit files to be generated on central server.

[Shibin_2]

Use audsys command to start / stop auditing on your system.

Read man audsys for more information.

I am not sure, whether you can keep it in a remote server.

/.secure/etc/audnames File contains the current and next audit file names and their switch sizes.

[Shibin_2]

Additionally, read this thread.

http://forums11.itrc.hp.com/service/forums/questionanswer.do?admit=109447626+1288679848061+28353475&threadId=815962

[Hakki Aydin Ucar]

You need to go to SAM > Security > Audit Events

But you need to convert your system Trusted Systems.

And you need to start by Turn Auditing ON from Actions menu.

And remember/be careful, it means too much logs under /.secure/etc

[Ramasubramanian Krishna]

thanks. But I need the audit files created to be on the central server.

[Sundar G]

Ram,

Try exploring the use of syslog-ng which sends all logs to a centralised server (including syslog). It is bundled with DASU tools in HP UX 11.31 . This link may be helpful.

http://forums11.itrc.hp.com/service/forums/questionanswer.do?admit=109447626+1288780164926+28353475&threadId=1179562

-- Sundar

[Dennis Handly]

>I need the audit files created to be on the central server.

Is NFS available to do this?

[Court Campbell]

I agree with Dennis. You will probably need to go the NFS route. Alternatively, you could write a script that changed the log file, and copied the log file off to another server. I did this at my last company. We switched out the audit file via a cronjob and sent it to a management server.

A couple of notes:

1. Make sure the audit info is useful. I cannot tell you how much crap info you can get from auditing. Do you really need to know every semop call?

2. Make sure you have a good amount of space for the logs. If the system cannot write to the audit files, your system will grind to a halt.

[Ismail Azad]

Just one thing, if u are doing via command line. Check the control variable in /etc/rc.config.d/auditing it will typically be 0 so make it as 1.

[Shibin_2]

I have assigned points to 1 of 13 responses to my questions.


Please assign some points.