Resource requirements for auditing

[adam donald]

I would like to enable auditing on our HP-UX systems to track user and system activities. Is there a document available that helps plan for hard disk space requirements when auditing is enabled?

[Bill Hassell]

Not really. As with all logging, it depends on what you enable for auditing. You may see the logfiles growing at a few megs per day or a few megs per minute. The most important change is to specify a new location for the two auditing files. By default, they are on /, a very bad place for log files. I would start with a dedicated lvol, perhaps 1-3 Gb in size, then tell auditing where this mountpoint is located. Be sure to read the man pages for the auditing system, and have a plan for analyzing and archiving the results. Most of the time, the audtiting files will probably be skipped over and just held for record purposes.

Remember that the more items you pick for auditing, the faster the logfiles will grow. Be sure you know how to terminate auditing in case you need to stop the logs.

[Robert Fritz]

Hi there,

There's not a lot of planning ducumentation out there, as frankly it depends on how much logging you do and how busy your system is.

Here's a link to the doc though:

http://docs.hp.com/en/5991-1821/ch06s03.html

and here's a relevent reference I found (Though I know *I'd* leave a lot more than 5MB... they did say minimal.):

"Choose a file system with adequate space for your audit log files. You can assess the size of your file systems using the bdf command. HP recommends you configure your log files to at least the following parameters:

*The file system must have more than 5000 KB available for the primary audit log file.
*It must have more than 20% of its total file space available.

Tip: HP recommends that the primary and auxiliary audit log files reside on separate file systems.

[adam donald]

Bill, Robert

Thank you for taking the time to answer my question.


AD

[adam donald]

My question was answered with users suggestions and prior experience, as well as a link to a document that addressed the topic of my question:
http://docs.hp.com/en/5991-1821/ch06s03.html