Audit my trusted 11.23 box.

[AbhilashPaul]

hello,
My box is running by 11.23 and its a trusted sever, now i have to take user auditing of this server, pls anyone send me the proc. to how to take auditing reports from this server.( how to configure ? )

[Johnson Punniyalingam]

>> i have to take user auditing of this server, pls anyone send me the proc. to how to take auditing reports from this server.( how to configure ? )<<<

Enable Auditing its big topic, you need read below link and understand.

http://docs.hp.com/en/B2355-90121/ch02s05.html

[Johnson Punniyalingam]

SAM --> Auditing and Security -> SAM Audited Events -> Under this look for sucessfull login&logout

1) Enable "Turn Auditing ON"

2) Select the users want to audit

3) Actions -> View Audit Log...

[ Audit Log... ] /var/.audit/audfile1

Once the auditfile has been created as shown above loacted, you need create /audit/archieve -> file system to archieve the audit logs.
hence the auditfile will be stored under /var file system if you d'not acrihive or purge the old auditfiles /var file system may grow high
so you need write script to check the audit file size than stop the audit than move the old audit files under /audit/archieve file system
once the audit file has been generated.

you even use SAM or command line to check audit file has below

man audisp -> more information to audit particulare user from auditfile.