0

Recently I was working trying to activate the solaris audit service to record logs and write them in a single file in /var/adm/auditlog.

The thing is, I was trying to find some useful info about it over internet and I could not found it too much.

First, I checked the audit service status with auditconfig -getcond and it is Enable, I disable the audit service using -t parameter with the command audit. (audit -t). And enable it again with root user.

I have the default auditing parameters (audit_event, audit_class, policies, etc). And I don't know where these logs are written or I don't know how can I make that the audit logs saved in a single file.

Please, any help with my case?.

See ya,

Improve this question
15
  • 1
    It sounds like you want to have syslog log the audit records. See How to Configure syslog Audit Logs
    – Mark Plotnick
    Jun 7, 2017 at 15:48
  • Hello Mark, Im having a problem and Im a little bit stuck, I installed a clean Solaris 11.3 version in a VirtualBox as a Virtualization Software Management, and I did these steps. auditconfig -getcond --> It shows me the audit is enable. Auditing. Also, I did the steps that Oracle site describes me and I could not obtain that audit logs can be saved in the syslog on /var/ directory. I launched this commands auditconfig -getflags and auditconfig -getnaflags and I obtain the default Solaris 11.3 configuration by default, I did not change anything about this config.
    – vicdeveloper
    Jun 18, 2017 at 2:54
  • Also, I saw the auditing policy using this command: auditconfig -getpolicy and I have the cnt active as default. About the audit plugins, I used this command: auditconfig -getplugin and I have audit_binfile plugin, audit_syslog active and audit_remote inactive. I edited the /etc/syslog.conf file and add this line: audit.notice /var/adm/auditlog. I dont know what Im doing wrong :(.
    – vicdeveloper
    Jun 18, 2017 at 2:55
  • If you use the logger command to send some text to audit.notice, does it appear in the auditlog file?
    – Mark Plotnick
    Jun 19, 2017 at 21:00
  • Hello Mark, I use this command: logger system rebooted and it does not write me anything in the auditlog file in /var/ directory. Any help?.
    – vicdeveloper
    Jun 20, 2017 at 15:15

2 Answers 2

Reset to default
3

If you kept everything out-of-the-box: Did you look into /var/audit . Keep in mind that in the default configuration of Solaris the files are in a binary format. You need to look at them with the praudit command.

Improve this answer
1
  • Is not needed other configuration files to do the auditing service work as well in Solaris 11?. I was watching some files, such as audit_control, audit_user into /etc/security directory. Any idea of an example of how to config them?.
    – vicdeveloper
    Jun 20, 2017 at 19:19
0

What does auditconfig -getcond show you?

This would show you some of the base config options, and where the binary audit data is going:

auditconfig -getplugin audit_binfile

Plugin: audit_binfile (active) Attributes: p_age=0h;p_dir=/var/audit;p_fsize=0;p_minfree=1

Have you checked the audit services in SMF? As well as the others in case something that auditd depends on is in maintenance? ie: svcs -a |grep audit; svcs -xv

I asked about the first, as for some reason on one of my Solaris 11 systems, the auditd service fails to start, and I've been unable to find a way to kick it to life.

Auditing in Oracle Solaris 11

Improve this answer
2
  • auditconfig -getcond ==> this command shows me: auditing. And the service is Enable and working as well.
    – vicdeveloper
    Jun 8, 2017 at 16:26
  • So, it sounds like it's working, so you should see audit files in "p_dir" which will require an auditreduce/praudit to view. Or check out the link Mark Plotnick gave you to configure syslog auditing.
    – sleepyweasel
    Jun 8, 2017 at 21:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .