Looking for a better auditing solution

[Paul Maglinger]

Running HP-UX 11.23. Some servers are ServiceGuard clustered, some are not. Some servers using NIS for authentication, some not. I'm looking for a solution that will quite simply tell me when a file was modified, when, what file, by who, and put it in log file. If it could send a notification, that would icing on the cake. HP-UX auditing output seems too cryptic, plus it has a problem with NIS. Many references to auditing in the forums go to dead links. Alot of threads are just dead-ends. Does someone have a recommendation, HP or otherwise, that is better than the auditing supplied with HP-UX?

[Duncan Edmonstone · Accepted solution]

Paul,

I guess the most welll known 3rd party solution in this space is Tripwire.

It's available as an open source product (compile yourself as far as I know, unless there are binaries out there somewhere):

http://sourceforge.net/projects/tripwire/

Or as a commercial product:

http://www.tripwire.com

HTH

Duncan

[Duncan Edmonstone]

Didn't look hard enough!

There is a compiled version of Tripwire available in the HP-UX Internet Express Bundle here:

https://h20392.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=HPUXIEXP1123

HTH

Duncan

[Paul Maglinger]

Open Source Tripwire seems to be the solution here. I was disappointed in HP's Internet Express version. It apparently didn't install all the components it needed. The Open Source version needed some tweaking and did have to be compiled, but it is working. Thanks!