HP-UX Security

[remonsamir]

For PCI requirement I started to implement Security and Auditing tools in SMH , and it worked successfully .
Now I need Centralized tools to collect all logs from all system in one data base to consume size of these files in every individual server and to be easiest way to monitor these logs
If SIM sufficient to do that .. how can I do that with sim ?
If not what is the tool to do that
Please Help me..

[Mel Burslan]

edit (if it is not there, then create) /etc/syslog.conf

inside the file, type these lines:

*.alertroot
*.debug@10.1.1.10

here means hitting the tab key once do not literally type it. syslog.conf file does not understand space character. delimiter is tab character.

also replace the ip address 10.1.1.10 with the log server's IP address.

How you can analyze the central log repository is totally up to you there are many log miner utilities out there. But for the PCI people, just showing them the syslog.conf files from the source servers and giving them the raw log files should be sufficient. They have their own tools to analyze those files if they want to.

[bibith dathan]

Hi

For PCI Audit they need
1.access log (su , sftp ,ssh etc)
2.system logs (syslogs)
2 file integrity reports
4. Capacity planning report ( Hp openview capacity advisor reports are good for this )


You can enable access logs reach at syslog and then route those logs to a machine with huge space ( we call it as log server ) . then you can enable auditing and using cron job move this audit files in every one hour to log server . You can use HIDS for FIM ( file integrity monitor)

ArcSight Logger is one of best tool for log management.

/Bibith