- Book Information
- Preface
- Chapter 1 Auditing Basics
- Auditing Overview
- The Audit Mechanism
- Audit Flags
- The audit_warn Script
- Controlling Audit Costs
- Auditing Efficiently
- The auditconfig Command
- Setting Audit Policies
- Chapter 2 Auditing Setup
- Planning Auditing at Your Site
- Rolling Out Auditing at Your Site
- Audit Shutdown and Startup Procedures
- Basic Audit Setup Procedures
- To Create Dedicated Audit Partitions
- To Execute Commands that Require Privilege
- To Remove Free Space (Optional)
- To Protect an Audit File System
- To Create an Audit Directory
- To Share an Audit File System
- To Mount an Audit File System
- To Reserve Free Space on an Audit File System
- To Specify the Audit File Storage Locations
- To Set Audit Flags
- To Set User Exceptions to the Audit Flags
- To Warn of Audit Trouble
- To Set Audit Policy Permanently
- To Distribute Audit Configuration Files to a Network of Workstations
- To Allocate and Deallocate Devices
- Advanced Audit Setup Procedures
- Dynamic Procedures
- Chapter 3 Audit Trail Management and Analysis
- The Audit Trail
- Audit Record Format
- Audit Files
- Audit Files Management
- Merging the Audit Trail
- Selecting Records from the Audit Trail
- Using the auditreduce and praudit Commands
- To Read a Closed Audit File
- To Read a Current Audit File
- To Display Several Audit Files as One Audit File
- To Print an Audit Log
- To Display User Activity on a Selected Date
- To Print User Activity on a Selected Date
- To Copy Login/Logout Messages to a Single File
- To Display Audit Records Created Before or After a Designated Date
- To Find an Audit Event
- To Combine Selected Audit Files
- To Reduce Audit Files
- To Change the praudit Field Separator to a Tab
- To Change the praudit Token Separator to a Tab
- To Perform Selections Using a praudit Script
- Audit Files Backup and Recovery
- Chapter 4 Troubleshooting Auditing
- Appendix A Event-to-Class Mappings
- Audit Events Listed by Audit Class
- Events in Audit Class aa
- Events in Audit Class ao
- Events in Audit Class ap
- Events in Audit Class cl
- Events in Audit Class fa
- Events in Audit Class fc
- Events in Audit Class fd
- Events in Audit Class fm
- Events in Audit Class fn
- Events in Audit Class fr
- Events in Audit Class fw
- Events in Audit Class io
- Events in Audit Class ip
- Events in Audit Class lo
- Events in Audit Class na
- Events in Audit Class no
- Events in Audit Class nt
- Events in Audit Class ot
- Events in Audit Class pm
- Events in Audit Class ps
- Events in Audit Class as
- Events in Audit Class ss
- Events in Audit Class ax
- Events in Audit Class xa
- Events in Audit Class xc
- Events in Audit Class xl
- Events in Audit Class xp
- Events in Audit Class xs
- Audit Events Listed by Audit Class
- Appendix B Audit Record Descriptions
- Audit Record Structure
- Audit Token Structure
- acl Token
- arbitrary Token
- arg Token
- attr Token
- clearance Token
- exec_args Token
- exec_env Token
- exit Token
- file Token
- groups Token (Obsolete)
- header Token
- host Token
- in_addr Token
- ip Token
- ipc Token
- ipc_perm Token
- iport Token
- liaison Token
- newgroups Token
- opaque Token
- path Token
- priv Token
- privilege Token
- process Token
- return Token
- seq Token
- slabel Token
- socket Token
- socket-inet Token
- subject Token
- text Token
- trailer Token
- xatom Token
- xclient Token
- xcolormap Token
- xcursor Token
- xfont Token
- xgc Token
- xpixmap Token
- xproperty Token
- xselect Token
- xwindow Token
- Audit Records
- Appendix C Audit Reference
- Index