Can I add a timestamp to the RBAC Audit log?

[Shah Sahib]

We have the full Security containment bundle installed on our HPUX 11.23 Server, including RBAC 11.23.04

Is there a way to add a time stamp to the events captured by the audit log?

Secondly, how can I re-direct the output of the audit log and merge it with the syslog so we have only one log to monitor?

Thank you

[Ivan Krastev]

See -t and -s switches of audisp - http://docs.hp.com/en/5991-8678/ch06s03.html#badgcgga

and audsys for changing the log files - http://docs.hp.com/en/5991-8678/ch06s03.html#v817856


regards,
ivan

[Shah Sahib]

Thanks Ivan, Those time switches are for filtering events during certain times, but I need a way to put a timestamp on the events being audited.

Auditing is not very useful if I cannot prove to an auditor who logged in when. For some reason the -u switch will not work for our audisp cmd and I have to grep for a user, that shows me all enteries for a user or event, but no time stamps.

The second doc you mention will overwrite the syslog if I specify it in the audsys cmd path, I need to have it merged into the syslog and not overwrite it.

The Auditor wants to be able to look in the syslog and view the audit log and see timestamps. In the very least see timestamps to verify without a doubt when the event occured. System time can be changed after an event has occured and would not be useful to just use the -t or -s cmd after an event has occured. Sorry if I am not very clear.

[Shah Sahib]

Closing, thanks