System call to flush or null a file

[coollllllllllll]

Hi ,

What is the system call from unix end to flush or nullify a file.

am thinking of starting auditing of my hpux boxxes 11.23 ,  wherein some major system calls to be monitored for some users.

like root oracle , application user.

what should i use "audevent -P -s ????"  here to catch hold of someone trying to flush a file  or flushed a file .

[Dennis Handly]

To catch trying to reset the EOF of a file, you need to look for open with O_TRUNC.

[coollllllllllll]

Hi Dennis ,

Thanks

Also i have observed that "rm " is not getting captured via auditing  i.e audevent  is there any way i can track it ??? 

[Dennis Handly]

>I have observed that "rm" is not getting captured

rm is an unlink(2).

[coollllllllllll]

Hi Dennis ,

Can i have auditing enabled only for some specific commands  and for some specific users ONLY like ,

rm

rm -rf

someone flushing  a file

someone renaming a file

someone copying a file

[Dennis Handly]

>Can I have auditing enabled only for some specific commands?

Only if you log execution of that command.  I.e. open that executable.

Or there is a system call that the command does.

I assume if you have auditing turned on, you can filter for specific users.

>someone renaming a file

This is a rename.

>someone copying a file

This is some opening that file.

[coollllllllllll]

Hi Dennis ,

I didnt get it.

Only if you log execution of that command, open that executable.

Or there is a system that the command does.

[Dennis Handly]

>I didn't get it.

I've updated the post and fixed a few missing words.

[chindi]

Hi Matti ,

Can you please help me here with your inputs.

[Dennis Handly]

>Can you please help me here with your inputs?

What's your question?