HP UX Auditing System Extensions manual Newgrp1 modaccess

Page 10

groupadd(1M) (admin)

Attempt to add a new group failed A new group added successfully. groupname=name gid=gid group_members=uid list

groupdel(1M) (admin)

Attempt to delete a group failed

A group with groupname=name is deleted successfully

groupmod(1M) (admin)

Attempt to modify a group failed

The group record of groupname=%s is modified successfully [New_groupname=name]

[ gid=gid]

[New_group_members=uid list]

inetd(1M)

inetd: Failed setauduser for user username

init(1M) (admin)

Run level is changed to level Dead process: pid

lpsched(1M) (open)

File(s) filename(s) was printed for user username @ hostname on printer printer name

File(s) filename(s) was not printed for user username @ hostname on printer printer name due to an error.

newgrp(1) (modaccess)

newgrp=name [FailedSuccessful] newgrp newgrp=name setresuid failed

passwd(1) (admin)

User= username passwd successfully changed User= username shell successfully changed

User= username home directory successfully changed User= username gecos information successfully changed Attempt to change <passwdshellhomegecos information> failed

privedit(1M) (admin)

ACCESS CONTROL CHECK: privedit: attempt to edit file: file=’filename’; username=username; program=privedit; euid=euid; ruid=ruid; egid=egid; rgid=rgid;

ACCESS CONTROL CHECK: privedit: failed to edit file: file=’filename’; username=username; program=privedit; euid=euid; ruid=ruid; egid=egid; rgid=rgid;

privrun(1M) (admin)

ACCESS CONTROL CHECK: privrun: attempt to execute command: command=command; username=username; program=privrun; euid=euid; ruid=ruid; egid=egid; rgid=rgid;

10

Image 10
Contents Configuring and Managing the Auditing System HP-UX 11i v2 and 11i v3 SecurityAudience IntroductionAuditing system overview CommandsArchitecture Daemons System callsFiles Audit trail Audit tagsAudit events PID identification records Version recordsSystem call table records System call audit recordsAudit tunable parameters HP-UX 11i v3 only Self-auditing programsAudit aware Page Newgrp1 modaccess Setfilexsec1M modaccess Could not lock file Audit unaware Executing login pid = pid. ipcopenNetworking service = ftp Remote user Usernameunspecified Local SystemDynamically Linked Kernel Modules Auditing system extensions HP-UX 11i v3 onlyAudit Filtering Installation HP-UX Auditing System AdministrationAudit Reporting Configuring users for audit ConfigurationUserdbset command. See userdbset1M and userdb4 Configuring audit filtering Configuring events for auditConfiguring audit settings to be preserved across reboots Configuring roles Role, operation, objectEnabling auditing Reads the /etc/rc.config.d/auditing fileManagement Disabling auditingDpms service module implementation Writing a Dpms service moduleService Provider Interfaces SPIs Best practicesAudit policy Audit generation and captureAudit retention and storage Audit log analysisAudit log configuration, security, and protection TroubleshootingOpt/audit/AudReport/bin Page Glossary Audwrite2Page For more information Send comments to HP