How to audit someone changing the servers time.

[Victor Mendham]

Can anyone give me some hints on how to audit for someone changing the servers time?

The time was changed to 26-Sep-2004 and then back to 25-Sep-2004.

I think you need OPER and LOG_IO priv to change the time.

I tried to do an anal/audit/event=time/since=25-sep-2004:21:00/before=25-sep-2004:23:30

But I do not get any events even though the time was changed either by a batch process or an interactive user.

[Lokesh_2]

Hi Victor,

You need to enable audit for time.

$SET AUDIT/ENABLE=TIME/AUDIT
$SET AUDIT/ENABLE=TIME/ALARM

Then you will find time change information in your security audit file.

HTH,
Thanks & regards,
Lokesh

[Ian Miller.]

Its not audited by default but can be. Commands to enable audit records and opcom security alarms have been given by Lokesh already.

[Willem Grooters]

Victor,

First shot, I could think of.
I'm not sure what class the system time is, but this may help once that's figured out:

$ SET AUDIT/CLASS=/ENABLE

(Perhaps the security manual tells you more)


HTH

Willem

[Victor Mendham]

ok so in order to use the anal/audit/event=time I need to enable time auditing.

Any idea how much this will add to my audit file, it is already 3 gb in size per month.

Is there any way to see anything in any other log ( like operator.log etc..), which might indictate changes?

Thanks Vic...

[Lawrence Czlapinski]

If your audit files are that large, it is good to create new audit files on a regular basis, either monthly, weekly or whatever frequency seems reasonable to you.
See link for a way of doing this:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?admit=716493758+1096501334712+28353475&threadId=581282
Lawrence

[Victor Mendham]

Lawrence, not sure if you noticed, but that original posting was from me as well.

Thanks.

[Ian Miller.]

"Any idea how much this will add to my audit file, it is already 3 gb in size per month."

One record per time change - not a lot.

I think you should be creating a new audit file more often than once per month. Did you do the changes as suggested by John Gillings et al in your previous thread?

[Lawrence Czlapinski]

Victor, actually I did notice that you had made the post with the information on creating new audit file, etc. So I knew you knew how to do that but felt it was good to have a link to it. I forgot to put a note in my post saying that.
NOTE: By the way, for reference in OpenVMS System Management Utilities Reference Manual: A-L, the default audit file is SYS$MANGAGER:SECURITY.AUDIT$JOURNAL. [Victor knows that.]
Lawrence

[Victor Mendham]

I didn't change the resubmit as we didn't have any issues. I did originally have a problem where I wasn't specifing the cluster and fixed that. Because HP suggested the stop, we used the stop rather than /new-file. So far we are happy with the roll-over every month to a seperate directory which gets offloaded to tape for archive.

I also just recently received the 7.3-1 security guide in pdf, so we now have that to assist us.

I just found out the time issue wasn't on our server, but rather on the server where the db was running, so the problem appears in the log where we call from the db and it relfected the issues with their clock, before they blew up and had their clock replaced.

Many Thanks for all the help