Auditing on Individual User Accounts

[Brian Miller_1]

From everything i've read and heard, there's no way to turn on auditing for one individual user account. instead you would have to turn on global auditing for the server. first of all, is this 100% correct, and if not does anyone know how to turn auditing on for an individual account only?

[Brian M. Fisher · Accepted solution]

In order to use HP's auditing you must:
1) Turn auditing on (SAM or audsys)
2) Use the audusr command to identify which users to audit. By default ALL users are audited.
3) Use audevent to identify which events and systems calls to audit
4) Use audisp to display the functions of the audit log file

I believe all of these functions can be performed through SAM once the system has been converted to a "Trusted System"

If you only need to audit a single user HP's auditing tool will be a VERY ugly approach.

Brian
<*(((>< er