AIX: Configure AIX Audit in Stream Mode

From Wiki

AIX Audit Series of Articles

Configure Audit

Step 1: Create a Backup of the Files

To ensure safety, create backups of the audit configuration files: 

cd /etc/security/audit

cp config config_original

cp streamcmds streamcmds_original

Modify the File /etc/security/audit/config

start:
       ignorenonexistentity = no
       binmode = off
       streammode = on
       fullpath = on
...
custom_audit =FILE_Open,FILE_Read,FILE_Write,FILE_Rename,...,PROC_Execute,USER_Shell

users:
   default = custom_audit

Save and close

Modify the File /etc/security/audit/streamcmds

/usr/sbin/auditstream | auditpr -t0 -h eclrRpPd -w > stream.out &

Save and close

Run audit

1) Stop Audit 

audit shutdown

2) Start Audit 

audit start


Sample output

Thu Jul 25 19:56:22 2024 FILE_Open       cecuser  cecuser  OK          ls                              7471614  7274804          flags: 67108864 mode: 0 fd: 3 filename /home/SW/dir1
Thu Jul 25 19:56:22 2024 FILE_Close      cecuser  cecuser  OK          ls                              7471614  7274804          file descriptor = 3

Ver também

Retrieved from "https://ebasso.net/wiki/index.php?title=AIX:_Configure_AIX_Audit_in_Stream_Mode&oldid=9046"