HP UX 11i Role-based Access Control (RBAC) Software Auditing Users, Performance Considerations

3.Set the audit log file monitor arguments in the /etc/rc.config.d/auditing file. Set the same values you used in step 2.

4.(Optional) Stop system auditing using the following command:

#audsys -f

5.(Optional) Set the AUDIT flag to 0 in the /etc/rc.config.d/auditing file to keep the auditing system from starting at the next system reboot.

Performance Considerations

Auditing increases system overhead. When performance is a concern, be selective about what events and users are audited. This can help reduce the impact of auditing on performance.

Guidelines for Administering Your Auditing System

Use the following guidelines when administering your system:

•Check the audit logs according to your security policy. An online audit file should be retained for at least 24 hours and all audit records stored offline should be retained for a minimum of 30 days.

•Review the audit log for unusual activities, such as: late hours login, login failures, failed access to system files, and failed attempts to perform security-relevant tasks.

•Prevent the overflow of the audit file by archiving daily.

•Revise current selectable events periodically, especially after installing new releases of HP-UX, since new system calls are often introduced in new releases.

•Revise audited users periodically.

•Do not follow any pattern or schedule for event or user selection.

•Set site guidelines. Involve users and management in determining these guidelines.

Auditing Users

By default, when system auditing is on, the audit status for all users is on. New users added to the system are automatically audited.

You can monitor what users are doing on HP-UX systems using the auditing. To change which users are audited, choose one of the following options:

•Audit all users.

By default, audit status for all users is set to on when the audit system is turned on. New users added to the system are automatically audited.

If auditing is turned off for all users, set AUDIT_FLAG=1 in the /etc/default/security file.

•Do not audit any users.

To turn off auditing for all users, follow these steps:

1.Check to see which users are already being audited. To check, follow these steps:

a.Check the AUDIT_FLAG setting in the /etc/default/security file.

b.Check the AUDIT_FLAG setting stored in the user database using the following command:

# userdbget -a AUDIT_FLAG

2.Set AUDIT_FLAG=0 in the /etc/default/security file.

•Audit specific users. To configure auditing for specific users, follow these steps:

Auditing 77