Tripwire on HPUX 11i

[douglas stradford]

I am working on tripwire on HP UX 11i servers. I am mainly working in area of the event tracking that Tripwire is supposed to do, and working at same time with the auditing of HP. Tripwire has said there is a big issues with the auditing of events as they dont track complete pathnames. Tripwire gives confusing information when gathering information on deleted files, updated file. Anyone deep into this also?
Thanks
Doug

[Steven E. Protter]

One of the last things I did on my last job was Tripwire on a trusted system.

I didn't see any point in monitoring the audit files, since Tirpwire.

Tripwire can establish a good database of binary files, even configuration files. audit files are data files, which are supposed to change a lot. Not sure tripwire is the right tool for monitoring them.

SEP

[Geoff Wild]

I'm running Tripwire on non-trusted 11iv1 servers with no issues at all...

I look at Application, OS, and DB files...

Rgds...Geoff

[douglas stradford]

We monitor a lot of files, application and os. But, I want specifics on who/when someone say, removes a file. Without hp auditing, you cant get all that information.

[Steven E. Protter · Accepted solution]

I agree.

Tripwire is the wrong tool for the job.

Tripwire spots changes in files, binary and config. It is really good at that.

Tripwire is not good at dealing with things that change a lot, like oracle databases and the audit files.

I think you need to write a script to monitor that audit database for issues you deem important.

SEP

[douglas stradford]

Steve
You may be correct. Will have to knock it around here and see what information tripwire and hp can provide reliably. Tripwire does tout being able to track things down to who and when.
Thanks for you thoughts.
Doug