Unix Tipz & Tricz

Auditing Users

By default, when system auditing is on, the audit status for all users is on. New users added to the system are automatically audited.

You can monitor what users are doing on HP-UX systems using the auditing. To change which users are audited, choose one of the following options:

• Audit all users.

By default, audit status for all users is set to on when the audit system is turned

on. New users added to the system are automatically audited.

If auditing is turned off for all users, set AUDIT_FLAG=1 in the /etc/default/security file.

• Do not audit any users.

To turn off auditing for all users, follow these steps:

1. Check to see which users are already being audited. To check, follow these steps:

a. Check the AUDIT_FLAG setting in the /etc/default/security file.

b. Check the AUDIT_FLAG setting stored in the user database using the following command:

# userdbget -a AUDIT_FLAG

2. Set AUDIT_FLAG=0 in the /etc/default/security file.

• Audit specific users.

To configure auditing for specific users, follow these steps:

1. Deselect auditing for all users by setting the AUDIT_FLAG=0 in the /etc/default/security file.

2. Configure auditing for a specific user using the following command:

# /usr/sbin/userdbset -u user-name AUDIT_FLAG=1.

If the audit system is not already enabled, use the audsys -n command to start the auditing system. Auditing changes take effect at the user's next login.

The audited information can be viewed in the audit log files which can be created as below:

Configuring Audit Trails

Use the audsys command to specify the primary audit log file to collect auditing data:

#audsys -n -N2 -c my_audit_trail -s 5000

This example starts the audit system and records data in the my_audit_trail directory, using two writer threads. The size is set to 5000K bytes.