Questions about auditing

[Timothy Czarnik]

Hey all,

We had the /.secure/etc filesystem file up a few days ago. This caused some pretty major headaches, and in hindsight I believe I was probably auditing too much, but I've come here to put it to the pros and see what they think.

I'm wondering what others out here audit for. We really only have 4 or 5 people with command line access to the system, and so I'm interested to hear what people think. Is there a reason to have auditing turned on at all?

Thanks for all the input in advance!

Tim

[Hazem Mahmoud_3]

Well, there is definitely a benefit to turning it on. A lot of times, someone could execute something without realizing that it caused any harm. If auditing is enabled, it allows you to see what happened. So it's intention is not just for malicious behavior, but also for tracking activity in general to help determine why something is now not working the way it should.
If system utilization is an issue, take a look at Powerbroker. It does not drain the system as much as other auditing tools.

-Hazem

[Sundar_7]

Hi Tim,

I dont use auditing and dont believe many uses auditing either. But that doesnt mean auditing is a total waste :-)

One usage I can think of is, it helps to audit the file/dir removal, file permission changes and other whole lot of events.

I would rather turn it on when required for a period of time and turn it off when I am done with it.

Sundar.

[hein coulier]

According to me, auditing on hpux is pretty
useless (or i don't know how to use it).

I will give you an example : if you do
something on a file, audisp will return
you an inode and a driveid (or something like that). How the hell can one determine
the real filename ? With a global find ?

Should there be a great light that knows the
answer : enlight me too !