HP-UX sam Security Audit Settings Success and Failure

[johnnymac_1]

Very new to HP-UX. When using the sam interface and setting up the audit settings for some items (example login) I cannot change the setting to Success and Failure. I can pick only one example Success Yes, Failure Yes but not Success and Failure. On other settings I don't have a problem. Is this a bug with sam and if so is there a patch or config file I can edit?

[RickT_1]

According to the System Admin Guide (Security Management), You can run the following command: "audevent -P -F -e login"
and that should give you what you are looking for.

Hope this solves your problem. I'm not sure about how SAM should work for this.

Rick

[johnnymac_1]

Rick T,
Thanks for your advice. I will try it today and respond to this posting with my results.

Take care,
John

[johnnymac_1]

RickT,
After performing the steps below at the command line, it appeared to take my inputs. The sam GUI did not reflect the change and the audevent man page mentioned that changes take affect immediatley. I provoked a failed login and it did not appear to have entered it after viewing the file while in sam. Next I performed a man page on last and observed lastb as a utility (I use this in Red Hat). Provoked lastb and the response was an error referencing the source file. The man page on last told me where to find the source file and it was missing. In your /var/adm directory do you have a btms file or btmps? My HP-UX OS is B.11.23. New to HP-UX so please forgive me.

[Pete Randall]

What does the output of "ll /var/adm/*tmp*" show? Something like this?

# ll /var/adm/*tmp*
-rw------- 1 root other 7920 Nov 22 06:22 /var/adm/btmp
-rw-rw-r-- 1 adm adm 1620 Jan 13 00:05 /var/adm/wtmp
-rw-r--r-- 1 root sys 280 Jan 13 00:05 /var/adm/wtmpx

If either btmp or wtmp are missing, try recreating an empty file by running "> /var/adm/wtmp" or "> /var/adm/btmp" as required.


Pete