onaudit problems after upgrading from11.10.FC2 to

Posted in 2009

Topics: Security, Permissions & Auditing

KARL OLIVER — Sun, 13 Sep 2009 21:37:48 — source: IIUG Forums & Mailing Lists

Hoping some one out there can help with on audit problems. Since upgrading from 11.10.FC2 to 11.10.FC3 onaudit is not working correctly on one server and not working at all on others. So we now have 9 instances with out functioning audit. The problem where onaudit is not working correctly is as follows I have set onaudit level to 1 with no audit masks So in theory nothing should be audited onaudit -o shows nothing audited as you would expect: Do you wish to continue? [y/N]: y paqis The sysaudit table in sysmaster shows nothing either: username paqis succ1 0 succ2 0 succ3 0 succ4 0 succ5 0 fail1 0 fail2 0 fail3 0 fail4 0 fail5 0 1 row(s) retrieved. Yet when I set audit level to 1 hundreds of OPDB are logged see below. The informix support team is unable to reproduce the problem - so I am hoping that someone else has struck the issue and can shed some light on the problem NLN|2009-09-14 09:13:16.000|auwsp123.dmz.maf.govt.nz|10855|asp132_ecms_live_rep|ecert|0:OPDB:ec _live:0:- ONLN|2009-09-14 09:13:19.000|wuasp132|2923|asp132_ecms_live_rep|informix|0:OPDB:sysmaster:0:- ONLN|2009-09-14 09:13:21.000|wuwsp133.dmz.maf.govt.nz|29342|asp132_ecms_live_rep|ecert|0:OPDB:ec _live:0:- ONLN|2009-09-14 09:13:21.000|auwsp123.dmz.maf.govt.nz|10855|asp132_ecms_live_rep|ecert|0:OPDB:ec _live:0:- ONLN|2009-09-14 09:13:21.000|wuwsp133.dmz.maf.govt.nz|29342|asp132_ecms_live_rep|ecert|0:OPDB:ec _live:0:- ONLN|2009-09-14 09:13:22.000|wuwsp133.dmz.maf.govt.nz|29206|asp132_ecms_live_rep|ecert|0:OPDB:ec _tm2_live:0:- ONLN|2009-09-14 09:13:26.000|auwsp123.dmz.maf.govt.nz|10855|asp132_ecms_live_rep|ecert|0:OPDB:ec _live:0:- ONLN|2009-09-14 09:13:32.000|auwsp123.dmz.maf.govt.nz|10855|asp132_ecms_live_rep|ecert|0:OPDB:ec _live:0:- ONLN|2009-09-14 09:13:37.000|auwsp123.dmz.maf.govt.nz|10855|asp132_ecms_live_rep|ecert|0:OPDB:ec _live:0:- ONLN|2009-09-14 09:13:43.000|auwsp123.dmz.maf.govt.nz|10855|asp132_ecms_live_rep|ecert|0:OPDB:ec _live:0:- ONLN|2009-09-14 09:13:44.000|wuwsp133.dmz.maf.govt.nz|28978|asp132_ecms_live_re

↪ replying to KARL OLIVER

Fernando — Mon, 14 Sep 2009 20:30:14 — source: IIUG Forums & Mailing Lists

Which user did you use to run onaudit? Regards, On Sun, Sep 13, 2009 at 10:37 PM, KARL OLIVER <karl.oliver@maf.govt.nz>wrote: > Hoping some one out there can help with on audit problems. > Since upgrading from 11.10.FC2 to 11.10.FC3 onaudit is not working > correctly > on one server and not working at all on others. So we now have 9 instances > with out functioning audit. > The problem where onaudit is not working correctly is as follows > I have set onaudit level to 1 with no audit masks > So in theory nothing should be audited > onaudit -o shows nothing audited as you would expect:> > Do you wish to continue? [y/N]: y > paqis > > The sysaudit table in sysmaster shows nothing either: > username paqis > succ1 0 > succ2 0 > succ3 0 > succ4 0 > succ5 0 > fail1 0 > fail2 0 > fail3 0 > fail4 0 > fail5 0 > > 1 row(s) retrieved. > Yet when I set audit level to 1 hundreds of OPDB are logged see below. > The informix support team is unable to reproduce the problem - so I am > hoping > that someone else has struck the issue and can shed some light on the > problem > > NLN|2009-09-14 > 09:13:16.000|auwsp123.dmz.maf.govt.nz > |10855|asp132_ecms_live_rep|ecert|0:OPDB:ec_live:0:- > ONLN|2009-09-14 > > 09:13:19.000|wuasp132|2923|asp132_ecms_live_rep|informix|0:OPDB:sysmaster:0:- > ONLN|2009-09-14 > 09:13:21.000|wuwsp133.dmz.maf.govt.nz > |29342|asp132_ecms_live_rep|ecert|0:OPDB:ec_live:0:- > ONLN|2009-09-14 > 09:13:21.000|auwsp123.dmz.maf.govt.nz > |10855|asp132_ecms_live_rep|ecert|0:OPDB:ec_live:0:- > ONLN|2009-09-14 > 09:13:21.000|wuwsp133.dmz.maf.govt.nz > |29342|asp132_ecms_live_rep|ecert|0:OPDB:ec_live:0:- > ONLN|2009-09-14 > 09:13:22.000|wuwsp133.dmz.maf.govt.nz > |29206|asp132_ecms_live_rep|ecert|0:OPDB:ec_tm2_live:0:- > ONLN|2009-09-14 > 09:13:26.000|auwsp123.dmz.maf.govt.nz > |10855|asp132_ecms_live_rep|ecert|0:OPDB:ec_live:0:- > ONLN|2009-09-14 > 09:13:32.000|auwsp123.dmz.maf.govt.nz > |10855|asp132_ecms_live_rep|ecert|0:OPDB:ec_live:0:- > ONLN|2009-09-14 > 09:13:37.000|auwsp123.dmz.maf.govt.nz > |10855|asp132_ecms_live_rep|ecert|0:OPDB:ec_live:0:- > ONLN|2009-09-14 > 09:13:43.000|auwsp123.dmz.maf.govt.nz > |10855|asp132_ecms_live_rep|ecert|0:OPDB:ec_live:0:- > ONLN|2009-09-14 > 09:13:44.000|wuwsp133.dmz.maf.govt.nz|28978|asp132_ecms_live_re > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > -- Fernando Nunes Portugal http://informix-technology.blogspot.com My email works... but I don't check it frequently... --000e0cd39c7a4e757c04738f888a

↪ replying to Fernando

KARL OLIVER — Mon, 14 Sep 2009 21:14:11 — source: IIUG Forums & Mailing Lists

using informix . role separation not being used

↪ replying to KARL OLIVER

KARL OLIVER — Mon, 14 Sep 2009 23:05:39 — source: IIUG Forums & Mailing Lists

More information - I think I know why all opdb were logged - I had a user ecert accessing system that did not have specific mask. Removed opdb from _require and recording stopped. Why when you do onaudit -o is not _require mask shown? Where does this information reside? Why is dir /opt/informix/dbssodir not mentioned as being new under IDS 11? Was not there under version 9. Why does onaudit not report when adding/deleting mask - always seems to work in silent mode? When I delete all audit masks with onaudit -d and set audit level to 0 all auditing stops fine, But when I try to set it all up again with exactly the same script I used to set up under version 9 it does not work, something must have changed to cause auditing to stop but I can find it in the documentation anywhere. We have struck more bugs under IDS 11 than I can count on my fingers and toes than we ever struck under IDS 9- excuse the rant but its becoming so frustrating hitting problems that werent in IDS 9.