performance hit of turning on auditing

[Eric Steed_1]

I'm looking for a ball park idea of how much of a penalty turning on auditing will do to the system. I'm talking about auditing to it's furthest extent. Any percentages? 10%? 20%?

This is on a DB server running Tru64 v5.1b in a cluster.

[Ann Majeske]

Why do you want to turn on all auditing? Normally that would only be used for a short time to debug a specific problem. You would not only have the performance issues (which I don't think would be that big), but you would use up disk space at an incredible rate. Full auditing audits all syscalls that happen on the system.

If you turn on a more reasonable subset of auditing, i.e. the Server or Timesharing profile, the performance hit is small enough it is pretty much unmeasurable. Then you can always turn on all auditing only when you have a need for it.

[Eric Steed_1]

Here is what I am required to audit system wide:

1. Log on attempts (successful and unsuccessful)
2. Security Administration and other Priviledged user activity.
3. End user activity, such as the initiation of transactions, sending of messages, etc.
4. The transport and/or manipulation of commands, data and other events between applications
5. All authorization

Do you think I could get away with less than full auditing for this stuff?

[Ann Majeske]

Eric,

You certainly don't have to turn on auditing fully to get what you need, but it might take some work to figure out exactly what your audit configuration should be.

I'd start with the Timesharing or Timesharing extended audit profile and see if that meets your needs. You could always add additional syscalls and/or files to be audited if necessary to meet your requirements.

There's information on configuring audit in the Security manual (Security Administration manual for V5.1B) as well as the auditmask and auditd man pages.

Ann

[Eric Steed_1]

OK- I'll take a look at that. It sounds like our previous assumption that the performance impact would be too great is not true anymore. Thanks for your input!