Re: How to determine auditing on/off

On Mon, May 7, 2012 at 7:14 AM, MICHAL KIEK <michal.kiek@gmail.com> wrote: > So, it's for security monitoring purposes. Actually I need to check: > - auditing enabled/disabled > The ONAU events in the audit log will assist here. If it is disabled, it will be just about the last entry in the log. > - audit log cleared > This is a file system event; nothing in Informix can help you here. At least, I'm assuming that you're looking to see whether an audit log file is truncated or deleted. > - audit log modified > Also a file system event; nothing in Informix can help you here. Again, I'm assuming you're looking to see whether an audit log file is modified outside the program. If you are seeking information about whether/when the audit log file is changed, then there is an alarm event for that, like there is for when logical logs are switched. > - auditing configuration changed > There are two ways to alter the auditing configuration: 1. The onaudit command - which will be logged if you've got auditing on and ONAU being logged. 2. Editing the audit configuration file ($INFORMIXDIR/aaodir/adtcfg or adtcfg.NN for server number NN). The second is a file system event; nothing in Informix can help you there. It also won't take effect until the server is restarted. The monitoring software is checking log file, if specific event come it > produce an alert. > So I need to specify which mnemonic represents each of above events that I > want to monitor. > The ones that result from onaudit being run will have ONAU as the mnemonic. The ones that result from editing the file outside of Informix will have no trace. I turned on auditing on a system that was running without auditing (server number 31; server name toru_31; server time zone is UTC0). Then I turned it off. $ onaudit -p $INFORMIXDIR/aaodir/log -l 7Onaudit -- Audit Subsystem Configuration Utility $ lsadtcfg adtcfg.31 adtcfg.std adtlog.31 log $ ls log toru_31.0 $ cat log/* ONLN|2012-05-07 14:41:26.602|toru|20947|toru_31|informix|0:UPRW:sysmaster:223:1025:0:1025:256:: ONLN|2012-05-07 14:41:26.644|toru|20947|toru_31|informix|0:ACTB:sysmaster:informix:syscrtadt:224 ONLN|2012-05-07 14:41:26.658|toru|20947|toru_31|informix|0:ONAU:-p /work4/informix/ids-11.70.FC4/aaodir/log -l 7 ONLN|2012-05-07 14:41:26.659|toru|20947|toru_31|informix|0:INRW:sysmaster:224:1026:7428:: ONLN|2012-05-07 14:41:26.659|toru|20947|toru_31|informix|0:CLDB:sysmaster $ onaudit -l 0Onaudit -- Audit Subsystem Configuration Utility $ cat log/* ONLN|2012-05-07 14:41:26.602|toru|20947|toru_31|informix|0:UPRW:sysmaster:223:1025:0:1025:256:: ONLN|2012-05-07 14:41:26.644|toru|20947|toru_31|informix|0:ACTB:sysmaster:informix:syscrtadt:224 ONLN|2012-05-07 14:41:26.658|toru|20947|toru_31|informix|0:ONAU:-p /work4/informix/ids-11.70.FC4/aaodir/log -l 7 ONLN|2012-05-07 14:41:26.659|toru|20947|toru_31|informix|0:INRW:sysmaster:224:1026:7428:: ONLN|2012-05-07 14:41:26.659|toru|20947|toru_31|informix|0:CLDB:sysmaster ONLN|2012-05-07 14:44:01.623|toru|21041|toru_31|informix|0:STSN ONLN|2012-05-07 14:44:01.637|toru|21041|toru_31|informix|0:OPDB:sysmaster:0:- ONLN|2012-05-07 14:44:01.638|toru|21041|toru_31|informix|0:ACTB:sysmaster:informix:sysadtinfo:223 ONLN|2012-05-07 14:44:01.639|toru|21041|toru_31|informix|0:RDRW:sysmaster:223:1025:0:: ONLN|2012-05-07 14:44:01.641|toru|21041|toru_31|informix|0:ACTB:sysmaster:informix:sysadtinfo:22 3 ONLN|2012-05-07 14:44:01.643|toru|21041|toru_31|informix|0:RDRW:sysmaster:223:1025:0:: $ I didn't use the server in between. Of course I don't have audit log after disabling an auditing, but the event > ("auditing disabled") should be stored in audit file and then alert should > be generated. > > Hope it's enough for you guys > > Does IDS generate event in audit log if you enable/disable auditing and > how it > looks like? > -- Jonathan Leffler <jonathan.leffler@gmail.com> #include <disclaimer.h> Guardian of DBD::Informix - v2011.0612 - http://dbi.perl.org "Blessed are we who can laugh at ourselves, for we shall never cease to be amused." --f46d04083989e76d1404bf73e5a1