Trusted System Auditing of file activity

[Michael Ernstoff]

I have switched on auditing of file activity in order to monitor updates to a specified list of files.
It seems that HP-UX (11.0) does not always record the pathname.
If I am an /etc and I do "echo test > filename" then the audit entry gives the file as "filename". If I do "echo test > /etc/filename" then the audit entry gives the file as "/etc/filename".
Is there a switch or a patch to make auditing record the absolute pathname every time?

[eran maor]

Hi

you are rigth . try to find info about 11.00 on the pathname but find only the fix for 10.20 - s700 10.20 audit record full pathname fix .

but didnt found any fix to 11.00 .

will try to find data in out channel but it will take a few days .

will keep you update if i will have an answer

[Michael Ernstoff]

Thanks for that. I had done a search of 11.0 patches but did not do one on 10.20

Let me know if you find anything out.

[Michael Ernstoff]

This problem is listed as fixed in the 10.20 patches and 11.0 status (patch equivalency) document.