AIX: Configure AIX Audit in BIN Mode: Difference between revisions
No edit summary |
|||
| (4 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
AIX Audit Series of Articles | |||
* [[AIX: Configure AIX Audit in BIN Mode]] | |||
* [[AIX: Configure AIX Audit in Stream Mode]] | |||
* [[AIX: Filtering content in AIX Audit]] | |||
| Line 20: | Line 26: | ||
streammode = off | streammode = off | ||
fullpath = on | fullpath = on | ||
bin: | |||
trail = /audit/trail | |||
bin1 = /audit/bin1 | |||
bin2 = /audit/bin2 | |||
binsize = 10240 | |||
cmds = /etc/security/audit/bincmds | |||
freespace = 65536 | |||
... | ... | ||
custom_audit =FILE_Open,FILE_Read,FILE_Write,FILE_Rename,...,PROC_Execute,USER_Shell | custom_audit =FILE_Open,FILE_Read,FILE_Write,FILE_Rename,...,PROC_Execute,USER_Shell | ||
| Line 28: | Line 41: | ||
Save and close | Save and close | ||
== Modify the File /etc/security/audit/ | == Modify the File /etc/security/audit/bincmds == | ||
/usr/sbin/auditpr -t0 -h eclrRpPd -w -i $bin > $bin.out | /usr/sbin/auditpr -t0 -h eclrRpPd -w -i $bin > $bin.out | ||
| Line 34: | Line 47: | ||
Save and close | Save and close | ||
Auditbin will alternate the value of $bin, to | Auditbin will alternate the value of $bin, to the value of bin1 and bin2 from config file. | ||
== Run audit == | == Run audit == | ||
Latest revision as of 18:20, 3 December 2024
AIX Audit Series of Articles
- AIX: Configure AIX Audit in BIN Mode
- AIX: Configure AIX Audit in Stream Mode
- AIX: Filtering content in AIX Audit
Configure Audit
Step 1: Create a Backup of the Files
To ensure safety, create backups of the audit configuration files:
cd /etc/security/audit cp config config_original cp streamcmds streamcmds_original
Modify the File /etc/security/audit/config
start:
ignorenonexistentity = no
binmode = on
streammode = off
fullpath = on
bin:
trail = /audit/trail
bin1 = /audit/bin1
bin2 = /audit/bin2
binsize = 10240
cmds = /etc/security/audit/bincmds
freespace = 65536
...
custom_audit =FILE_Open,FILE_Read,FILE_Write,FILE_Rename,...,PROC_Execute,USER_Shell
users:
default = custom_audit
Save and close
Modify the File /etc/security/audit/bincmds
/usr/sbin/auditpr -t0 -h eclrRpPd -w -i $bin > $bin.out
Save and close
Auditbin will alternate the value of $bin, to the value of bin1 and bin2 from config file.
Run audit
1) Stop Audit
audit shutdown
2) Start Audit
audit start
Sample output
Thu Jul 25 19:56:22 2024 FILE_Open cecuser cecuser OK ls 7471614 7274804 flags: 67108864 mode: 0 fd: 3 filename /home/SW/dir1 Thu Jul 25 19:56:22 2024 FILE_Close cecuser cecuser OK ls 7471614 7274804 file descriptor = 3