Accounting & Auditing

[SR_2006]

Hi,
Difference between accounting & auditing.
For what purpose these are used.
How to enable accounting & auditing in HP-UX
thanks in advance.

Sanjay.....

[Steven E. Protter]

Shalom,

Auditing is something you do after the fact. You look at a system and do an "audit" of what happened.

Accounting is really not a computer function, its bean counting.

To enable auditing, convert your system to trusted mode. Some docs may use the terms interchangeabley, in my opinion thats bad English.

SEP

[Darrel Louis]

Hi Sanjay,

Your system needs to be in Trusted mode:
To convert the system into trusted system the command is :
/usr/lbin/tsconvert

After converting it will create a directory /tcb/files/auth/*/*
Note: before converting into trusted system you have to modify /etc/nsswitch.conf file. In that file â passwd compact â has to be changed into â passwd filesâ

To unconvert the trusted system with the following command:
/usr/lbin/tsconvert â r

To enable auditing, you need to set the parameter,AUDITING=1, in /etc/rc.config.d/auditing file.

Thread:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1031009

See following link for more info:
http://h20293.www2.hp.com/portal/swdepot/displayProductInfo.do?productNumber=StdModSecExt

Darrel

[Darrel Louis]

Have you checked the man-pages aswell for configuring auditing:
Auditing configuration. See audsys(1m), audevent(1m)

Darrel

[SR_2006]

I am already using tcb.
One more thing that , I am not able to login directly using superuser I have to login with normal user & use su - to login.Also I checked /etc/nsswitch.conf but this file does not exists in both node of my cluster.
thanks.

[Darrel Louis]

Hi,

If you do a ll nsswitch*, you will see several examples. You can copy /etc/nsswitch.files to /etc/nsswitch.conf and then edit the file.
Are you using ssh or rlogin?
Check if the file /etc/securetty exists with "console" as content?
If yes this is the reason why you can't login as superuser.

Darrel