How to determine auditing on/off

Posted in 2012

Summary

A newcomer asked which audit-event mnemonics in the Informix audit log indicate that auditing was turned on or off, as he wanted monitoring software to alert on auditing being enabled/disabled, the audit log being cleared or modified, and audit configuration changes. Suggestions were to consult the Informix Security Guide and to check the audit level via the onaudit command or the sysmaster sysadtinfo view, with a caution that onaudit mnemonics may not appear in the log depending on audit level. No answer identifying the specific mnemonics or a sample log entry was recorded in the thread.

Auto-generated by DrWatson from the posts below — may be imperfect; read the full thread.

Topics: Security, Permissions & Auditing

MICHAL KIEK — Sun, 06 May 2012 09:32:27 — source: IIUG Forums & Mailing Lists

Hi, which mnemonics determine auditing on/off in audit log? can someone send me a sample of audit log with auditing enable/disables entrys? thanks in advance, regards Michal

↪ replying to MICHAL KIEK

Art Kagel — Sun, 06 May 2012 15:19:07 — source: IIUG Forums & Mailing Lists

Read the Informix Security Guide manual. Art Art S. Kagel Advanced DataTools (www.advancedatatools.com) Blog: http://informix-myview.blogspot.com/ Disclaimer: Please keep in mind that my own opinions are my own opinions and do not reflect on my employer, Advanced DataTools, the IIUG, nor any other organization with which I am associated either explicitly, implicitly, or by inference. Neither do those opinions reflect those of other individuals affiliated with any entity with which I am affiliated nor those of the entities themselves. On Sun, May 6, 2012 at 5:32 AM, MICHAL KIEK <michal.kiek@gmail.com> wrote: > Hi, > which mnemonics determine auditing on/off in audit log? > > can someone send me a sample of audit log with auditing enable/disables > entrys? > > thanks in advance, > regards > Michal > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > --e89a8f3ba95975729804bf5facd9

↪ replying to Art Kagel

MICHAL KIEK — Sun, 06 May 2012 16:02:31 — source: IIUG Forums & Mailing Lists

I did it and didn't find information that I need. Let me try to be more accurate. First of all, as you can see, I'm a total newbie. I need to determine whether auditing has been disabled/enabled, but only with the audit log. I have checked audit-event mnemonic list at: http://publib.boulder.ibm.com/infocenter/idshelp/v10/index.jsp?topic=/com.ibm.tf g.doc/tfg111.htm and I didn't find any that says "auditing on" / "auditing off" Obviously I googled a little before I post my question here and I've found that auditing can be enaled/disabled with command "onaudit". What I've found on mnemonic list is ONAU. Because I don't have access to informix yet, I want kindly ask you to send/show me a part of log with entry that says the log is enabled/disabled.

↪ replying to MICHAL KIEK

Fernando Nunes — Mon, 07 May 2012 09:47:32 — source: IIUG Forums & Mailing Lists

Your request seems a bit strange... Why do you need to find if the auditing is on or off based solely on the audit log...? Eventually if it's off you don't even have audit log. You can get the audit level by using onaudit or checking the sysmaster view "sysadtinfo". Depending on the audit level, the onaudit menemonics may not be on the audit log.... But please, tell us why you would need this. At this moment I have no idea. If you explain the need maybe there is another solution... Regards. On Sun, May 6, 2012 at 5:02 PM, MICHAL KIEK <michal.kiek@gmail.com> wrote: > I did it and didn't find information that I need. > Let me try to be more accurate. > > First of all, as you can see, I'm a total newbie. > > I need to determine whether auditing has been disabled/enabled, but only > with > the audit log. I have checked audit-event mnemonic list at: > > > > http://publib.boulder.ibm.com/infocenter/idshelp/v10/index.jsp?topic=/com.ibm.tf g.doc/tfg111.htm > > and I didn't find any that says "auditing on" / "auditing off" > > Obviously I googled a little before I post my question here and I've found > that auditing can be enaled/disabled with command "onaudit". > What I've found on mnemonic list is ONAU. Because I don't have access to > informix yet, I want kindly ask you to send/show me a part of log with > entry > that says the log is enabled/disabled. > > > > ******************************************************************************* > Forum Note: Use "Reply" to post a response in the discussion forum. > > -- Fernando Nunes Portugal http://informix-technology.blogspot.com My email works... but I don't check it frequently... --20cf302ef74c62ca7604bf6f27b5

↪ replying to Fernando Nunes

MICHAL KIEK — Mon, 07 May 2012 14:14:58 — source: IIUG Forums & Mailing Lists

So, it's for security monitoring purposes. Actually I need to check: - auditing enabled/disabled - audit log cleared - audit log modified - auditing configuration changed The monitoring software is checking log file, if specific event come it produce an alert. So I need to specify which mnemonic represents each of above events that I want to monitor. Of course I don't have audit log after disabling an auditing, but the event ("auditing disabled") should be storred in audit file and then alert should ben generated. Hope it's enough for you guys Does IDS generate event in audit log if you enable/disable auditing and how it looks like? thanks! ;)