SAM and Event Auditing

[Mark Stewart]

If you use SAM to perform sys admin tasks while Event Auditing is turned on, will tasks performed in SAM show up in the logs? For example, if I used SAM to add a new user to the system, would the event logs show that root made that addition? Or would I be looking for/need to be auditing a specific system call for it to show up? Thanks!

[Darren Prior]

Hi,

I don't believe there's a specific auditable event for adding a new user, after all there are several way of performing the task (of which SAM is just one.) If you use SAM to add a user then SAM's log will contain this information.

You could also check the audevent man page for info on the available auditable events and system calls. The process of creating the new user's home directory and entry in /etc/passwd can be captured by auditing.

regards,

Darren.

[Systeemingenieurs Infoc · Accepted solution]

sam uses the useradd function. It will show up if you enable the loggin of the execve (if i remember correctly).

Take it from me that it's not easy to filter the interesting stuff out of the garbage via audisp

hecou

[doug hosking]

Mark, check out patch PHCO_27018. That might be helpful to you.