show diff on audited files after editition AIX

CSIA AN
CSIA AN used Ask the Experts™
on
We have enabled  audit on files insode AIX systems and it's working as expected. For example, if you edit and change /etc/myfile.conf with VI, a record is shown on audit logs:

S_ENVIRON_WRITE root     root     Thu Feb 11 10:59:01 2016 OK          vi
         fichero audit object write event detected /etc/myfile.conf

But, the question:
 Is possible to audit, using auditbin,  the diff with original and the changed /etc/myfile.conf file?

If I remember well, auditd on Linux can do this.

Thanks.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Most Valuable Expert 2013
Top Expert 2013
Commented:
That's not possible, unfortunately.

AIX audit records would have to contain "before" and "after" images of file objects to perform a "diff",
which is not the case.

You cannot customize the content of an audit record, auditpr just formats the tail part of an audit record for readability,
as predefined in the events config and the head part according to various auditpr flags, that's all.

Sorry, no better news!

wmp

Author

Commented:
Thanks WMP!

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial