enable accounting in hpux

[Avinash Agarkar]

hi,

any body have idea on how to enable user accounting in hpux.

Thanks,
Avinash

[Duncan Edmonstone]

Haven't bothered with accounting in years... If you really want to do this, these are my notes from about 8 years ago on how to do it on 11.00. I can't imagine its changed significantly (if at all) since then. Still you might want to check all the scripts and files mentioned are still there...


____________________________________________

Create the following directory

/var/adm/sa

Add the following entried to the file /usr/spool/cron/crontabs/adm

# adm crontab file for
#
# Run Daily Accounting
0 4 * * 1-6 /usr/sbin/acct/runacct 2> /var/adm/acct/nite/fd2log
#
# Check size of /var/adm/pacct
0 * * * * /usr/sbin/acct/ckpacct
#
# Create summary files
15 5 1 * * /usr/sbin/acct/monacct
#
# Collect system accounting information and store in binary format
0 7-17 * * * /usr/lib/sa/sa1 1200 3
#
# Write a daily report to /var/adm/sa/sadd (where dd is day number)
0 18 * * 1-6 /usr/lib/sa/sa2 -s 7:00 -e 18:01 -i 3600 -A
#
# Disk Accounting
0 2 * * 4 /usr/sbin/acct/dodisk

Remove all comments from /etc/fstab (as some of the default accounting scripts don't handle them correctly)

Set flag to 1 in /etc/rc.config.d/acct, as follows:

#!/sbin/sh
# @(#) $Revision: 72.5 $
# Process accounting. See acct(1m)
#
# START_ACCT: Set to 1 to start process accounting
#
START_ACCT=1

Comment out the superfluous â dateâ commands in the script /usr/sbin/acct/dodisk (there are 2 lines which just call "date" but do nothing else). This prevents adm receiving pointless mail from cron with just date stamps in it

Set up /etc/acct/holidays file for the current year
____________________________________________

HTH

Duncan

[Avinash Agarkar]

thanks for you replay,

I wanted to know how do i enable user command accounting.

Thanks,
Avinash

[Duncan Edmonstone]

Can you clarify what you mean...

every command that every user types?

commands that privilidged users type?

Something else???

HTH

Duncan

[Ivan Krastev]

This is called auditing. See how to ebanle it and make it permanent - http://docs.hp.com/en/B3921-60631/audsys.1M.html

regards,
ivan

[Ivan Krastev]

And one very important thing - do not store auditing files in root / file system. Create separate partition(s) for that. Most of the cases for full root file system was related with audit files.

regards,
ivan

[Avinash Agarkar]

yes I want every command that every user types.

Thanks,
Avinash

[Duncan Edmonstone]

Thats what I was afraid you would say... the obvious question is why???

Do you record every mouse click and key press on your users PCs?

Or are we actually talking about adminsitrators who actually do nothing as theire own users... just login and then su to root or to a generic application admin.

Well you can get some basic stuff by collecting shell history files from users home directories, but of course users can edit and change those, so I'm assuming that won't fit what you want.

There are other things you can do... bit really it depends on what you are ultimately trying to achieve...

HTH

Duncan

[Sandeep_Chaudhary]

if trusted mode then:
1)modprpw -k username

[Duncan Edmonstone]

Sandeep, what on earth are you talking about???

modprpw -k

unlocks a users account... nothing to do with logging user commands etc....

Duncan

[Sandeep_Chaudhary]

sorry to read question wrongly.


the better and preferred way is to
give sudo access.
enable history for each user.


exampl of history:

-rw------- 1 root sys 58158 Sep 10 15:42 .sh_history.root-arpdh
-rw------- 1 root sys 58792 Sep 5 14:32 .sh_history.root-naumanna
-rw------- 1 root sys 47454 Sep 18 08:24 .sh_history.root-neumannl
-rw------- 1 root sys 42918 Sep 17 13:58 .sh_history.root-rau


for this i have set /etc/profile as :

# Set up shell environment (PROMPT, HISTORY ):
export WaI=`who am i | awk '{print $1}'`
export HISTFILE="$HOME/.sh_history.$LOGNAME-$WaI"

[SKR_1]

/usr/lbin/modprpw -k username ( to enable the ID )

/usr/lbin/modprpw -x username ( to reset the password )

Thanks

SKR

[Duncan Edmonstone]

Good grief...now SKR is doing it... for pete's sake READ THE QUESTION AND ALL RESPONSES BEFORE REPLYING YOURSELF

Duncan

(who seems to be getting very grumpy these days)