Auditing has moved in Redhat V4

[Robert Walker_8]

Hi,

Have been trying to set up a system configuration - which will use Auditing. We worked out in V3 etc that we could implement auditing and use aucat to get details from the Audit subsystem. We also we caught on the fact that auditing was generating 20mb a day audit logs and filling up var.

However, moving to RHEL4 aucat and audit are gone - replaced by auditctl and of course SELinux. Anyone got some details on this.

Would much appreciate.

Rob.

[Steven E. Protter]

They kind of pulled support and went to a different product on you, without adequate notice.

SELINUX will prevent you if active from doing things like having a httpd server thats no based in the /var filesystem. I generally turn it off or put it into warning mode on my RH/Centos boxes.

You are kind of stuck, probably needing to learn this new product which will probably have some similarities to the old product.

[Robert Walker_8]

Thanks,

Ok now what do most Linux sys admins do about tracking what happened where when who and how.

Under T64 and OpenVMS you can track down to whoes opening files etc.

This used to exist in V3 U4 but as I mentioned it has now gone?

Robert.