using the following audits: Admin Close Create Delete Modaccess Moddac Open Process - is it possible to restrict this to processes generated by command line access from a login? (i.e., I don't necessarily need to know about automated app processes, just commands run from a login shell) Removable Login
My customer has stated that it will cause problems with the applications. We are trying to understand the reason why, but this information is difficult to get.
Yes, I've read that document. It does not address this issue. Does all this silence mean nobody knows? If there is a way, I do not see it documented. I was hoping someone had found a flat file you can modify, something...
The choices for auditing are shownj in SAM. Since auditing occurs at the kernel level, individual files and directories can't be differentiated. You can audit reads and writes (which the kernel understands) but the actual filename is part of the user space. A user program requests that a file be opened by communicating with the LVM and filesystem code and gets back a file descriptor block. Reading and writing that file requires the filesystem code to translate the record in the file into an lvol block and the LVM code translates this into an actual kernel read/write request for the disk (which can be audited).
