Hello All,
I have configured auditing to give me an "exec" message each time a certain command is issued by a certain user but I cannot seem to log the syntax of the command, this is some text from the trail log:
RSH_Stat root OK Mon Jun 04 15:00:01 2007 rsh
audit object exec event detected /usr/bin/rsh
It tells me that the rsh command has been issued but not what was issued,ie
/usr/bin/rsh nodename date
Can the syntax be captured ?
Any help would be greatly appreciated,
cheers
Benno
...it really does get worse than this !!
I have configured auditing to give me an "exec" message each time a certain command is issued by a certain user but I cannot seem to log the syntax of the command, this is some text from the trail log:
RSH_Stat root OK Mon Jun 04 15:00:01 2007 rsh
audit object exec event detected /usr/bin/rsh
It tells me that the rsh command has been issued but not what was issued,ie
/usr/bin/rsh nodename date
Can the syntax be captured ?
Any help would be greatly appreciated,
cheers
Benno
...it really does get worse than this !!