HP UX Auditing System Extensions manual Management, Enabling auditing, Disabling auditing

Use an editor (for example, vi) to directly edit the

/etc/rbac/aud_filter file. The HP-UX RBAC administrative commands do not provide an interface to configure /etc/rbac/aud_filter.

Management

This section describes how to enable and disable auditing, and how to rotate audit log files.

Enabling auditing

To enable auditing, use one of the following methods:

•Enter the /sbin/init.d/auditing start command. When you do this, the following occurs:

–Reads the /etc/rc.config.d/auditing file.

–Displays events to be audited by running audevent using the AUDEVENT_ARGS flags.

–Turns on the auditing system by running audsys -n.

–When audsys is run for the first time, the command creates the /etc/audit/audnames file using the log file names and sizes specified by PRI_AUDFILE and SEC_AUDFILE. Thereafter, each time the audsys -ncommand is invoked, it uses the audit log names and sizes from the audnames file.

–Starts the audomon daemon with the AUDOMON_ARGS.

•HP-UX Security Attributes Configuration Tool

Used to view and configure system-wide and per-user (local users and NIS users) values of security attribute. You can launch this from the HP System Management Homepage (SMH) or HP System Insight Manager (SIM). For more information, see secweb(1M).

•Entering the audsys –nand audomon commands manually.

Disabling auditing

To disable auditing, enter the audsys –fcommand.

Rotating audit logs

To enable audit log rotation, run the audomon daemon. The audomon daemon monitors the capacity of the current audit trail and the file system on which the audit trail is located, by checking the FileSpaceSwitch (FSS) and AuditFileSwitch (AFS) switch points. If either switch point is reached, audit recording automatically switches to an alternative audit trail. For example, if the auditing system was started using audsys -n-c /var/.audit/my_trail-s 1000, the following command starts the audomon daemon:

audomon -p 20 -t 1 -w 90 -X "/usr/local/bin/rcp_audit_trail hostname”

This command has the following behaviors:

•The audomon daemon sleeps at least 1 minute at intervals.

•When the size of the current audit trail reaches 1000*90% or 900 kilobytes, or the file system that contains the current audit trail has reached (100%-20%) * 90% or 72% full, audomon starts printing warning messages to the console.

•When the size of the current audit trail reaches 1000 kilobytes, or the file system that contains the current audit trail has reached 100% - 20% or 80% full, audomon switches recording data to:

/var/.audit/my_trail.yyyymmdd_HHMM, where yyyymmdd_HHMM is replaced by the time when the switch has happened.

•After the switch succeeds, audomon invokes the following command:

18