Edit AIX Audit events

Hi,

These are the parameters when I do "audit query" and it's giving me a lot of logs.

auditing on
audit bin manager is process 23962
audit events:
        loginout - USER_Login,TERM_Logout,USER_Exit,USER_Logout,PROC_Execute
        ALL - AUD_CONFIG_WR,S_USER_WRITE,S_PASSWD_READ,S_PASSWD_WRITE,S_LOGIN_WRITE,S_LIMITS_WRITE,S_GROUP_WRITE,S_ENVIRON_WRITE,USER_Login,TERM_Logout,USER_Exit,USER_Logout,PROC_Execute,AUD_It,FILE_Open,PROC_Delete,FILE_Write,FILE_Close,AUD_Bin_Def,FILE_Stat,FILE_Read,PROC_Adjtime,TCP_ksocket,TCP_kconnect,TCP_kclose,PROC_Create,FILE_Fchown,FILE_Dupfd,PROC_Privilege,PROC_SetPri,FILE_Accessx,PROC_LoadError,FILE_Pipe,PROC_SetUserIDs,PROC_RealGID,CRON_Start,CRON_Finish,FILE_Unlink,TCB_Exec,AUD_Proc,SENDMAIL_Config,PROC_SetGroups,MAIL_ToUser,WLM_set,FILE_Fchmod,FILE_Rename,FILE_Mode,PROC_Setpgid,PROC_Limits,INIT_End,MSG_Read,FS_Chdir,SHM_Open,SHM_Detach,INIT_Start,FILE_ReadXacl,FILE_WriteXacl,FILE_Owner,FILE_Utimes,PROC_LoadMember,PROC_Load,TCP_ksetopt,TCP_kbind,PROC_Environ,TCP_kshutdown,FS_Fchdir,FILE_Link,FILE_FReadXacl,FILE_FWriteXacl

audit objects:
        /etc/security/audit/config:
                 w = AUD_CONFIG_WR
        /etc/security/limits:
                 w = S_LIMITS_WRITE
        /etc/security/group:
                 w = S_GROUP_WRITE
        /etc/security/environ:
                 w = S_ENVIRON_WRITE
        /etc/security/login.cfg:
                 w = S_LOGIN_WRITE
        /etc/security/passwd:
                 r = S_PASSWD_READ
                 w = S_PASSWD_WRITE
        /etc/security/user:
                 w = S_USER_WRITE


Here also is my audit config file

start:
        binmode = on
        streammode = off

bin:
        trail = /audit/trail
        bin1 = /audit/bin1
        bin2 = /audit/bin2
        binsize = 10240
        cmds = /etc/security/audit/bincmds
        freespace = 65536

stream:
        cmds = /etc/security/audit/streamcmds

classes:
        loginout = USER_Login,TERM_Logout,USER_Exit,USER_Logout,PROC_Execute

users:
        default = loginout


My question now is how can I remove the parameter "ALL" on the audit event. I only want to audit on those with "loginout".

Thank you.
mkuser01Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

woolmilkporcCommented:
Hi,
the 'ALL' class is implicitly defined and always there.
If you don't use it, it should do no harm. It is not active unless explicitly configured in the config file.
wmp
 
0
mkuser01Author Commented:
Hi,

I've isolated my problem by removing all the parameters under "classes" on /etc/security/audit/config file but I'm still getting bunch of logs.  Based on my configuration, there should be no logs right?  

Thank you in advance.

0
woolmilkporcCommented:
Well,

it seems that the 'users:  default ...' stanza
doesn't do what we want in your case, for whichever reason.

Please re-add your 'classes: ...' stanza
and add every concerned user under 'users: ...', either by editing the file directly or by issuing

chuser "auditclasses=loginout" [userid]

Should there be too many users to change manually, use this little script:

lsuser -a ALL | while read name ; do chuser "auditclasses=loginout" $name ; done

Take care to issue 'audit shutdown' and 'audit start' after making changes to reset the configuration in the kernel tables.

HTH

wmp
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Unix OS

From novice to tech pro — start learning today.