planning trusted system: size audit / audits-traps? / readable

[hagmann]

1) has anybody example of typical auditsize /per day /week?
(for case: "default-audit" / any other case with much more logfilesize?
2) is there possible to audit, if a (defined) user make access to (defined) file/directory?
3) are the default audits ok or do you have recommended additional audits?
(the customer focus: logon/-off, su, file/directoryaccess, failed access/ssh)
4) location of logfile? can I read it with vi/tail?
(copy -> collect -> transfer; or must be a daemon stopped/started
to save the files to other location?)

BTW: I seek the forums, the one and only site with *small* hints about sizing I discovered:
http://docs.hp.com/hpux/onlinedocs/B2355-90672/00/01/124-con.html

[Christopher McCray_1 · Accepted solution]

1) There really is no real specification as to the preferred audfile size; it will depend on the amount of activity on your machine. If you want it larger than 10000 KB, don't use sam, use the audsys command (see man pages).

2) Yes, sam has the comprehensiv list of auditing parameters under auditing and security.

3)Use your descretion, but be warned, your audit files can overwrite!

4) Anywhere you want, because the auditing system will put the file wherever your pwd is unless you specify the absolute path. The default directory is in sam. No, you can't read it with vi or tail; you need to run the audisp command to convert it(see man pages for all avail options).

I hope I've answered all your questions, but please feel free to inquire more about it as I have to be very aware of this where I work. Good luck!!

Regards,
Chris

[Samudrala Seshpani]

hi,

I want to perform auditing without turning trusted systems. What I want to audit is

1. User login/logoff successful.
2. USer login/logoff unsuccessful.
3. When user change password
4. Privilaged account like root file access and modifications.

Is there any command/script to gather information from datafile or logs.

Please help me.

Thanks