audit user creation/delete

[Titania]

Hello

I would like to know how to audit events like user creation/deletion/passwd modification etc, can be this done through SAM?

[Ralf Seefeldt]

Hi Titania,

SAM logs its actions in /var/sam/log/samlog.
There you should be able to find, what you are logging for. You may access the logfile by SAM
| Options | view SAM log or be texteditor.

To figure out, who performed any action, most of which nmay require root-permissions, you have to look at the information, stored in /etc/wtemp . You may access these with command "last" or, getting some additional information, by executing:
#cat /etc/wtmp | /usr/lib/acct/fwtmp | \ #tail -1000 > /etc/wtmp.txt #vi + /etc/wtmp.txt

Bye
Ralf

[Steve Steel]

Hi


http://docs.hp.com/en/5991-8678/ch06s03.html


Gives you the basics of real auditing


Steve Steel