![](/images/new-backgrounds/1330589/330589155x1.webp)
1.Deselect auditing for all users by setting the AUDIT_FLAG=0 in the
/etc/default/security file.
2.Configure auditing for a specific user using the following command
# /usr/sbin/userdbset -u user-name AUDIT_FLAG=1.
If the audit system is not already enabled, use the audsys
Auditing Events
An event is an action with security implications, such as creating a file, opening a file, or logging in to the system. You can audit events on an
NOTE: HP recommends that you audit the following three events at a minimum:
•admin
•login
•modaccess
Configure the events you want to audit before you turn on the auditing system. When an event type is selected, its associated system calls are automatically enabled. To configure events for auditing, use the audevent command. The syntax for the audevent command is as follows:
# audevent [options]
The following options are commonly used with the audevent command:
Table 6-7 audevent command options
audevent options | Description |
Logs successful event operations | |
Logs unsuccessful event operations | |
Specifies an event to log | |
Displays a complete list of event types and associated system calls | |
Change event or system call audit status | |
no option | display the current status of the selected events or system calls |
For example, to configure admin, login, and modaccess for auditing, enter the following command:
#audevent -P -F -e admin -e login -e moddac
Both Audit Success and Audit Failure are set as event types for monitoring successful and failed events or system calls. This is the minimum event type selection recommended for running a system.
A record is written when an event type is selected for auditing, and the user initiating the event has been selected for auditing. The login event is an exception. Once selected, the login event will be recorded whether or not the user logging in has been selected for auditing.
Streamlining Audit Log Data
Some processes invoke a series of actions that can be audited. To reduce the amount of audit log data collected and to provide for more meaningful notations in the audit log files, some of these
78 Standard Mode Security Extensions