Thanks for the info. I have looked into audit a couple times in the past but it overwelms me after awhile. What command are you using to extract user creation? BTW, I have found a great product that interacts with AIX audit. It is called Snare. They are in a testing phase currently for AIX...
Unfortunately, most users aren’t created via smit. Also, I think the audits are looking for something that can be run on a daily basis that would look for all users that were setup and then determine if any where setup that weren’t suppose to be.
We just had an audit done on our systems and one of the things that was asked of us was how did we know when a user was created. I have been trying to do some research and have been unable to find anything. Does anyone know how I can track/log user creation in AIX?
Nope, I still get the multiple alerts. The only differenct now is that I log everything to an Access database and I have a macro that goes and deletes all duplicates.
I added the $1 but still get multiple alerts.
This is the line from syslog.conf that tells it where to log the file.
daemon.notice /var/adm/daemon
And here is a snip of what /var/adm/daemon looks like after I run the following test (I received about 12 of these line)...
I am more interested in getting errpt to work with syslog. I have a syslog server already set up to gather all my notifications and I just want one central location to monitor al the servers. But thanks!
I am trying to set up errpt to log to syslog using the following:
errnotify:
en_pid = 0
en_name = "syslog"
en_persistenceflg = 1
en_label = ""
en_crcid = 0
en_class = ""
en_type = ""...
I am testing WinSyslog with one of my AIX servers and am running into a slight problem. It seems that the AIX system is sending multiple alerts for the same problem to the Syslog server. I have not been able to find a reason for this and was hoping that someone has run into it before. Thanks
The one thing that I wanted to stay away from was having to set up mail on all of my systems. I was hoping there was a Netsaint (I am actually using Nagios) like application that could alert me of new messages in the error log. I am presently looking into setting up syslog and having the...
I am looking for a utility that can monitor the error reports on all of my AIX boxes. Does anyone know of a web based or similiar utility that can alert/keep track of errors from one central location? Kind of like what Big Brother does for disk space, memory, etc.
What if you dont know the name of the user? I know a file was modified either by someone with root access or a member of the group that the file belongs too. I would like to know which user it was. Obviously if it was root, I wouldn't know, but if it was a user logged in under their name I...
This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
By continuing to use this site, you are consenting to our use of cookies.