Edit AIX Audit events

Posted on 2009-07-08
Medium Priority
Last Modified: 2013-11-17

These are the parameters when I do "audit query" and it's giving me a lot of logs.

auditing on
audit bin manager is process 23962
audit events:
        loginout - USER_Login,TERM_Logout,USER_Exit,USER_Logout,PROC_Execute
        ALL - AUD_CONFIG_WR,S_USER_WRITE,S_PASSWD_READ,S_PASSWD_WRITE,S_LOGIN_WRITE,S_LIMITS_WRITE,S_GROUP_WRITE,S_ENVIRON_WRITE,USER_Login,TERM_Logout,USER_Exit,USER_Logout,PROC_Execute,AUD_It,FILE_Open,PROC_Delete,FILE_Write,FILE_Close,AUD_Bin_Def,FILE_Stat,FILE_Read,PROC_Adjtime,TCP_ksocket,TCP_kconnect,TCP_kclose,PROC_Create,FILE_Fchown,FILE_Dupfd,PROC_Privilege,PROC_SetPri,FILE_Accessx,PROC_LoadError,FILE_Pipe,PROC_SetUserIDs,PROC_RealGID,CRON_Start,CRON_Finish,FILE_Unlink,TCB_Exec,AUD_Proc,SENDMAIL_Config,PROC_SetGroups,MAIL_ToUser,WLM_set,FILE_Fchmod,FILE_Rename,FILE_Mode,PROC_Setpgid,PROC_Limits,INIT_End,MSG_Read,FS_Chdir,SHM_Open,SHM_Detach,INIT_Start,FILE_ReadXacl,FILE_WriteXacl,FILE_Owner,FILE_Utimes,PROC_LoadMember,PROC_Load,TCP_ksetopt,TCP_kbind,PROC_Environ,TCP_kshutdown,FS_Fchdir,FILE_Link,FILE_FReadXacl,FILE_FWriteXacl

audit objects:
                 w = AUD_CONFIG_WR
                 w = S_LIMITS_WRITE
                 w = S_GROUP_WRITE
                 w = S_ENVIRON_WRITE
                 w = S_LOGIN_WRITE
                 r = S_PASSWD_READ
                 w = S_PASSWD_WRITE
                 w = S_USER_WRITE

Here also is my audit config file

        binmode = on
        streammode = off

        trail = /audit/trail
        bin1 = /audit/bin1
        bin2 = /audit/bin2
        binsize = 10240
        cmds = /etc/security/audit/bincmds
        freespace = 65536

        cmds = /etc/security/audit/streamcmds

        loginout = USER_Login,TERM_Logout,USER_Exit,USER_Logout,PROC_Execute

        default = loginout

My question now is how can I remove the parameter "ALL" on the audit event. I only want to audit on those with "loginout".

Thank you.
Question by:mkuser01
  • 2
LVL 68

Expert Comment

ID: 24803345
the 'ALL' class is implicitly defined and always there.
If you don't use it, it should do no harm. It is not active unless explicitly configured in the config file.

Author Comment

ID: 24829250

I've isolated my problem by removing all the parameters under "classes" on /etc/security/audit/config file but I'm still getting bunch of logs.  Based on my configuration, there should be no logs right?  

Thank you in advance.

LVL 68

Accepted Solution

woolmilkporc earned 1500 total points
ID: 24829779

it seems that the 'users:  default ...' stanza
doesn't do what we want in your case, for whichever reason.

Please re-add your 'classes: ...' stanza
and add every concerned user under 'users: ...', either by editing the file directly or by issuing

chuser "auditclasses=loginout" [userid]

Should there be too many users to change manually, use this little script:

lsuser -a ALL | while read name ; do chuser "auditclasses=loginout" $name ; done

Take care to issue 'audit shutdown' and 'audit start' after making changes to reset the configuration in the kernel tables.



Featured Post

The 14th Annual Expert Award Winners

The results are in! Meet the top members of our 2017 Expert Awards. Congratulations to all who qualified!

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Hello fellow BSD lovers, I've created a patch process for patching openjdk6 for BSD (FreeBSD specifically), although I tried to keep all BSD versions in mind when creating my patch. Welcome to OpenJDK6 on BSD First let me start with a little …
Why Shell Scripting? Shell scripting is a powerful method of accessing UNIX systems and it is very flexible. Shell scripts are required when we want to execute a sequence of commands in Unix flavored operating systems. “Shell” is the command line i…
Learn how to find files with the shell using the find and locate commands. Use locate to find a needle in a haystack.: With locate, check if the file still exists.: Use find to get the actual location of the file.:
This video shows how to set up a shell script to accept a positional parameter when called, pass that to a SQL script, accept the output from the statement back and then manipulate it in the Shell.

619 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question