Trusted System

[kholikt]

Hi,

We want to convert a group of machine to trust system so that we can turn on the auditing. Now my question is, can I forward the log generate by auditing to a central syslog server? The reason is the person who review the log will not be the administrator. The security personnel suppose to review the log in the central syslog server.

What is the list of events that can be audited in a trusted system?

Any difference between the events record in syslog and auditlog?

[Bill Hassell]

No, the log files generated by can be filled so fast that specialized logfiles are required. They can fill so fast that auditing will automatically switch between a first and second logfile. There is nothing in common with the syslog files. You need to spend some time with the man page:

man 5 audit

Also note that the default location for audit logfiles is /.secure which is never a good location. These logfiles will need to be stored in /var/adm like other logfiles. Note also that if you decide to turn on most of the auditing features, you'll be generating several hundred pages of paper every day and your system will run noticeably slower.

So you'll need to carefully choose the items to be audited. And the security reviewer will need a lot of scripting skills to summarize the logs.

[Steven E. Protter]

Shalom,

Its not syslog, it can't be sent out port 514 with the syslog.conf parameter.


There is no reason why you can't use an ssh script to move or copy the files periodically to a central storage system. Theres a questionof how useful they are after transfer.

There are a lot of events that can be audited on a trusted system. Default settings can generate a GB of data a month on an entry level system.

SEP