Event logging

[T Raeuchle]

Is there a logging mechanism that I can turn on that records events such as user login/logout, failed logins, file access, etc.

Thanks

TR

[Pete Randall]

Check out the last and lastb commands.


Pete

[Rick Garland]

This is enabled by default - check out the last, lastb commands.


Will tell you who logged in when and you failed to login and when.

For su access, look at the /var/adm/sulog

[Florian Heigl (new acc)]

Look for the manuals on the HP-UX trusted system operating mode, this is the way to gather all the data You listed.

[generic_1 · Accepted solution]

If you need more details you can turn on auditing, make sure you turn on just what you need and you have sufficient space for the logs. I would suggest a sepparate mount point for the logs.

[Mel Burslan]

In addition to all of the above, if you want to log the IP addresses of people who connected to this machine over the network, you can turn on inetd logging by :

/usr/sbin/inetd -k
/usr/sbin/inetd -l

and see the inetd connection IP addresses in your syslog.log

[Michael Selvesteen_2]

Auditing is the better solution for your problem. Use SAM to configure auditing in your machine. Select carefully the events which you need to monitor. Note currently SSH login/logout are not monitored by Auditing.

some important commands releated to auditing

1. audisp -e filename
2. audsys
3. audevent
4. audusr

Hope this helps.

[Muthukumar_5]

For auditing,

login/logout - last command (wtmp file tracking)
bad login - lastb command (btmp file tracking)
file access - You have to turn your system into trusted.

Go to sam -> auditing & security -> audited events, it will ask to ask to turn system trusted mode.

You can use .sh_history file to track which commands are executed with which file. You have to enable in /etc/profile for history logging as,

set -o $EDITOR
export $HISTFILE=$HOME/.sh_history
export $HISTSIZE=1000

hth.

[Mahesh Kumar Malik]

Hi TR

Logging fetures are available when you have Trusted System Environment. Once you have Trusted System, enable Auditing and ites options to enable logging of login/logout, failed logins, file access, etc

Regards
Mahesh