Send audit logging to syslog for centralized syslog server

[Paul Maglinger]

Running HP-UX 11.23. I'm wanting to send the auditing information to the syslog so it will go to our centralized syslog server. Because this additional logging has the potential to create big log files, I don't need or want them to be on the local system. I have been successful in getting the syslogs to go to the centralized syslog server by adding the following line in the syslog.conf file:
*.info @
I have tried using #audsys | logger and that doesn't seem to be working. Can anyone offer me some insight?

[Shibin_2]

I hope, this thread will be helpful to read.

http://forums13.itrc.hp.com/service/forums/questionanswer.do?threadId=1454565

[Paul Maglinger]

I don't believe this will work. This is on a system running NIS for authentication and therefore isn't trusted. The workaround I used was to installed enhanced security, which then allowed me to run auditing. I just can't get the auditing to go to the syslog. I tried installing syslog-ng, but I can't run the GUI on 11.23. The reference manual was too vague for me to be able to use. I do not wish to tail because I'd like it to be logged in real time. Putting it in cron would cause it to be batched, would it not? Any other thoughts from anyone?

[Paul Maglinger]

I have gone to another system that is not using NIS and implemented auditing. I have told it to audit create, delete, chmod, etc.

After which I did created a file using touch, chmod, chgrp, vi'ed the file, and then deleted it. Shouldn't I have been able to see these changes in the auditlog? And shouldn't it show the file that was created/changed/removed?

[Paul Maglinger]

I'm going back to square one. Can anyone tell me how to direct the auditing results either in addition to or just directly to the syslog?

[Bill Hassell · Accepted solution]

Assuming that auditing uses the auth facility, you can direct just the auth entries to your syslog server like this:

auth.info @

To keep the auth records from showing up in syslog.log, add: auth.none to the syslog.log entry like this:


*.info;mail.none;auth.none /var/adm/syslog/syslog.log
auth.info @

NOTE: NO SPACES! Every space in the syslog.conf file causes the entire to be silently ignored. Use TAB to separate elements.

However, it appears (man audsys) that audsys never uses syslog because the log can grow VERY fast (dozens of MB in minutes). Conversely, the default location for audsys logs is /, the dumbest place for log files. So you can script an audsys logfile scanner (tail will never work because the logfiles are switched regularly). The scanner would find the newest file, then use logger to extract the last record as well as determine (with wc) the file size. Then every few seconds, check the file size and grab all new records and send them using logger. The script will also have to monitor the audsys logfile switch. Not elegant, but that's the way audsys works.

NOTE: audsys can generate massively large logs and therefore massive network traffic when configured inappropriately.

[Paul Maglinger]

HP-UX auditing sure seems to be lacking in many respects. The output from audisp is cryptic at best. I can't see where it specifically shows that a file has been modified, a feature that would seem to be key to any auditing. If anyone knows of a better solution, I like to hear about it.