Audit Trail Format

[Andrew Kay_1]

Greetings,

I am attempting to write a program to read the Hewlett-Packard HP-UX audit
trail directly, rather than through the audisp program.

As far as I can tell all entries within the trail start with an audit_hdr
structure, as defined in 'sys/audit.h', I have sucesfully written a program
that reads the header structure for all entries.

For every process there will be one record as follows,

struct audit_hdr header;
struct pir_body pir;

again I have sucessfully written a program that reads such entries and stores
the pir_body structure to match with following records. I have also been
able to determine the number of and type of the event return values and
parameters by matching the event type with the aud_flag structure held within
the audparam table, as defined in 'sys/audparam.h'. I am however having
difficulty in reading the 'complex' values from the audit trail. According
to 'sys/audit.h' the audit_filename parameter structure is defined as,

u_long apn_cnode;
u_long apn_dev;
u_long apn_inode;
u_short apn_len;
char apn_path[MAXPATHLEN];
struct audit_filename *next;

however the parameter structure within the audit trail is of variable length
and in most cases far smaller than the structure above. I imagine such a
structure would be composed of a header, containing the cnode, device, inode
and path length, and a body containg the path, is this correct and what is
the header structure definition? I imagine also that the audit_string
paramater structure defined as,

unsigned a_strlen;
char a_str[MAXAUDSTRING];
struct audit_string *next;

in 'sys/audit.h' would be composed in a similar way to the filename paramater
structure, again what is the header structure definition?

As this is, as far as I know, not documented anywhere I am not to hopeful of
an answer unless of course someone from Hewlett-Packard is reading.


Signed
Andrew Kay

[Rob Viets]

I seem to have the need for a similar program.

I have not gotten as far as you. Were you able to resolve this?

[Muthukumar_5]

Hai,

We can audit the audit logs using audisp easily. There are all features to audit the logs with audisp ( by enabling the audting for the feature in SAM )

We can audit the process details using audisp. Go to SAM --> auditing and security --> audited events --> process ( event type ). Try to enable the success and failure. Using audisp -e process,we can audit the process related informations easily.

To know audit file information use audsys command without any argument or /etc/rc.config.d/auditing file to know the auditing file details.

Let us see why audit_filename structure is not defined as pir_header structure with pir_body,pir_t and pir_header ( with so many levels )

IF we are going to audit process then we have monitor a lot of process. process informations are stored with audit header for that process on the audit logs. General process oriented headers ( eventname idetification header is stored in the hdr[20] informations ) and process record structure pointer in the pir_header structure. Process record header and process information structure is used in the pir_t structure ( pid identification record ). Proces informations are stored in the pir_body structure.

pri_header --> pir_t --> pir_body structure links are needed to handle the process events and then process record informations and process informations.

Audit file management structure is not related to auditing events ( process etc ). One major Auditing file and the next file ( replacing auditing file ) is used for auditing the logs. There is no need to have the header informations of auditfilename or filename record structure details. Only audit filename informations are needed. And they are in fixed count not as like events ( process )

All features are included in the audisp,audsys, aud* commands with the support of SAM to control and handle the auditing easily and effectively.

Regards,
Muthukumar.