HPE Community
Operating System - HP-UX
1848254 Members
7913 Online
104022 Solutions
New Discussion

Re: set up auditing

 
Gary_O
Frequent Advisor

‎04-09-2004 02:51 AM

‎04-09-2004 02:51 AM

set up auditing

I would like to set up auditing to try and see why files/directories might be getting deleted. Also, seems I have ghost atjobs running (the #########.a file was manually removed from the atjobs directory, instead of using at -r)

What items should I audit for?
0 Kudos
Reply
3 REPLIES 3
Steven E. Protter
Exalted Contributor

‎04-09-2004 02:54 AM

‎04-09-2004 02:54 AM

Re: set up auditing

You can make your system trusted with the tsconvert command or

as root

sam
auditing and security

You should be able to turn on trusted system there.

There are impacts on cron users and such and the step should be planned carefully.

SEP
Steven E Protter
Owner of ISN Corporation
http://isnamerica.com
http://hpuxconsulting.com
Sponsor: http://hpux.ws
Twitter: http://twitter.com/hpuxlinux
Founder http://newdatacloud.com
0 Kudos
Reply
Gary_O
Frequent Advisor

‎04-09-2004 03:01 AM

‎04-09-2004 03:01 AM

Re: set up auditing

I do not want to complicate matters.

There are a LOT of events/calls that can be monitored. Can someone help me pinpoint the most pertinent for my needs?

And what is the impact on use of cron?
0 Kudos
Reply
Sundar_7
Honored Contributor

‎04-09-2004 08:20 AM

‎04-09-2004 08:20 AM

Re: set up auditing

Hi,

Audit the events delete and the system call unlink.

Sundar
Learn What to do ,How to do and more importantly When to do ?
0 Kudos
Reply
The opinions expressed above are the personal opinions of the authors, not of Hewlett Packard Enterprise. By using this site, you accept the Terms of Use and Rules of Participation.