The audit tag has no wiki summary.
1
vote
2answers
48 views
Auditing Linux: tell me to what IPs a connection was established
I need a command, or something that runs as a cron job, that logs what IPs my machine is communicating with, what ports, and what process did it.
2
votes
1answer
44 views
Proper syntax for “id -r” command
I'm trying to see if id -r will print out the UID or username of the user who logged into the system despite any su's or sudo's. I'm interested in doing this so I can keep people a little more ...
1
vote
2answers
41 views
How to find responsible script with ausearch results?
So I wanted to know which process is creating a directory ']' in my root. I was assuming this is some typo in some script. So I set up an audit for that directory, very similarly as shown on This ...
0
votes
1answer
20 views
Auditing of gdb commands
Is there a way I can log all gdb commands executed by a user?
And do user level logging?
Is any other tool like gdbserver can help in this case ?
0
votes
0answers
17 views
audit dir content removing / deletion [duplicate]
Possible Duplicate:
Is it possible to find out what program or script created a given file?
A peasant needs thunder to cross himself and wonder. A few minutes I get lost wp blog content the ...
6
votes
2answers
188 views
Is it possible to know who visited my home directory?
Suppose there are many users in a Linux cluster, each of them has his own HOME directory under /home/xxx, with xxx being his user name (or account). If the initial system configuration allows these ...
1
vote
0answers
53 views
AIX auditing for LDAP users
I've discovered a problem with the way AIX uses auditclasses to determine which system calls are audited. If a user is defined in LDAP, their auditclasses attribute is blank. I found an APAR which ...
0
votes
1answer
71 views
How to Install, Configure and Use LSAT
I saw a tool LSAT that is used for Security auditing of Linux Servers. But found not much material for LSAT. Can someone please provide help of how to
Setup
Configure
Use Lsat
9
votes
1answer
240 views
How do I monitor opened files of a process in realtime?
I know I can view the open files of a process using lsof at that moment in time on my Linux machine. However, a process can open, alter and close a file so quickly that I won't be able to see it when ...
14
votes
4answers
505 views
Finding command execution time in hindsight
I've just executed a long-running process from the bash prompt. In hindsight, I wish I'd run time on it, or noted down the time at which I kicked it off.
Is there any way of getting this information ...
2
votes
2answers
895 views
Display a file's history (list of users that have modified a file)
Is there a command to display a list of users who modified a file providing a file history?
I know that possible with svn/git etc.. but we have a config file that is not in SVN and someone modified ...
3
votes
1answer
236 views
Commands for Auditing Installed Software
Similar to the question here, http://serverfault.com/questions/387111/inventory-or-audit-installed-linux-software, I would like to obtain ideas about commands that should be ran across various ...
2
votes
2answers
127 views
Logging hidden file creations [duplicate]
Possible Duplicate:
Is it possible to find out what program or script created a given file?
Can I find somewhere in logs the times of creation of hidden files or directories under the ...
6
votes
2answers
213 views
How do I add network or user source connection data to history entries?
I would like to modify the history settings for all users on the systems that I manage.
I would like it to contain the information from the connecting terminal like from who
sysadmin:/ # who
sysadmin ...
