Configuring Audit Logs

Each plugin sends audit logs to a different location. The audit_binfile plugin sends records in binary format to local storage. The audit_remote plugin sends an audit record stream to a remote repository. The audit_syslog plugin sends a text summary of the audit record to syslog. By default, audit_binfile is the only active plugin.

The following task map points to the procedures for configuring audit logs for the various plugins. All tasks are optional.

How to Create ZFS File Systems for Audit Files

The following procedure shows how to create a ZFS pool for audit files, as well as the corresponding file systems and mount point. By default, the /var/audit directory holds audit files for the audit_binfile plugin.

Before You Begin

You must be assigned the ZFS File System Management and ZFS Storage Management rights profiles. The latter profile enables you to create storage pools.

1. Become an administrator with the required security attributes.

   For more information, see How to Obtain Administrative Rights.

2. Determine the amount of disk space that is required.

   Assign at least 200 MBs of disk space per host. However, how much auditing you require dictates the disk space requirements. So, your disk space requirements might be far greater than this figure. Remember to include a local audit directory of last resort.

3. Create a mirrored ZFS storage pool.

   The zpool create command creates a storage pool that is a container for the ZFS file systems. For more information, see What Is ZFS? in Oracle Solaris ZFS Administration Guide.

   # zpool create audit-pool mirror disk1 disk2

   For example, create the auditp pool from two disks, c3t1d0 c3t2d0, and mirror them.

   # zpool create auditp mirror c3t1d0 c3t2d0

4. Create a ZFS file system and mount point for the audit files.

   You create the file system and mount point with one command. At creation, the file system is mounted.

   # zfs create -o mountpoint=/mountpoint audit-pool/mountpoint

   For example, create the /audit mount point for the auditf file system:

   # zfs create -o mountpoint=/audit auditp/auditf

5. Create a ZFS file system for the audit files.

   # zfs create -p auditp/auditf/system/files

   For example, create a ZFS file system for the sys1 system.

   # zfs create -p auditp/auditf/sys1/files

6. (Optional) Create additional file systems for audit files.

   You can set ZFS quotas on file systems. These quotas are used by the audit_warn alias to notify you when the space is filling up.

   # zfs create -p auditp/auditf/sys1.1/files
   # zfs create -p auditp/auditf/sys1.2/files

7. Protect the parent audit file system.

   The following ZFS properties are set to off for all file systems in the pool:

   # zfs set devices=off auditp/auditf
   # zfs set exec=off auditp/auditf
   # zfs set setuid=off auditp/auditf

8. Compress the audit files in the pool.

   Typically, compression is set on file systems. However, because all the file systems in this pool contain audit files, compression is set at the pool level.

   # zfs set compression=on auditp

9. Set quotas.
   • Set a a quota on the parent audit file system.

     In this scenario, when the both disks in the auditp pool are almost full, the audit_warn script notifies the audit administrator.

     For example, set a quota on the auditf file system.

     # zfs set quota=510G auditp/auditf

   • Set a quota on the descendant audit filesystems.

     In this scenario, when an auditp/auditf/system file system is filling up, the audit_warn script notifies the audit administrator.

     # zfs set quota=170G auditp/auditf/sys1
     # zfs set quota=170G auditp/auditf/sys1.1
     # zfs set quota=165G auditp/auditf/sys1.2

     ---

     Note - If you have set a quota on the parent audit file system, quotas on the descendant file systems impose an additional limit.

     ---

10. For a large pool, limit the size of the audit files.

    By default, an audit file can grow to the size of the pool. For manageability, set a limit to the size of a file. See Example 30-13.

Example 30-12 Setting a Quota on the /var/audit Directory

In this example, the administrator sets a quota on the default audit file system. When this quota is reached, the audit_warn script warns the audit administrator.

# zfs set quota=252G /var/audit

How to Assign Audit Space for the Audit Trail

In this procedure, you use attributes to the audit_binfile plugin to assign additional disk space to the audit trail.

Before You Begin

You must be assigned the Audit Configuration rights profile.

1. Become an administrator with the required security attributes.

   For more information, see How to Obtain Administrative Rights.

2. Determine the attributes to the audit_binfile plugin.

   Read the OBJECT ATTRIBUTES section of the audit_binfile(5) man page.

   # man audit_binfile
   ...
   OBJECT ATTRIBUTES
        The p_dir attribute specifies where the audit files will be
        created. The directories are listed in the order in which
        they are to be used.
        
        The p_minfree attribute defines the percentage of free space
        that the audit system requires before the audit daemon invokes
        the audit_warn script.
   
        The p_fsize attribute defines the maximum size in bytes that
        an  audit  file can become before it is automatically closed
        and a new audit file  opened.  ...

3. To add directories to the audit trail, specify the p_dir attribute.

   The default directory is /var/audit.

   # auditconfig -setplugin audit_binfile active p_dir=/audit/example1/files,/var/audit

   The preceding command sets the /audit/example1/files directory as the primary directory for audit files, and the default /var/audit directory as the secondary directory. In this scenario, the /var/audit directory is the directory of last resort. For this configuration to succeed, the /audit/example1/files directory must exist.

   You created this directory in How to Create ZFS File Systems for Audit Files.

4. Refresh the audit service.

   The auditconfig -setplugin command sets the configured value. This value is a property of the audit service, so is restored when the service is refreshed or restarted. The configured value becomes active when the audit service is refreshed or restarted. For information about configured and active values, see the auditconfig(1M) man page.

   # audit -s

Example 30-13 Limiting File Size for the audit_binfile Plugin

In the following example, the size of a binary audit file is set to a specific size. The size is specified in bytes.

# auditconfig -setplugin audit_binfile active p_fsize=1024000
# auditconfig -getplugin audit_binfile
Plugin: audit_binfile (active)
    Attributes: p_dir=/var/audit;p_fsize=1024000;p_minfree=0;

The default value, 0, places no limit on the size of an audit file. To manage smaller file sizes, the administrator specifies a file size limit of 1MB. The audit service creates a new file when the size limit is reached. The file size limit goes into effect when the administrator refreshes the audit service.

# audit -s

Example 30-14 Specifying Several Changes to an Audit Plugin

In the following example, the administrator changes the queue size, the binary file size, and the soft limit warning for the audit_binfile plugin. The default queue size is the hiwater mark for the kernel audit queue, 100, as in active audit queue hiwater mark (records) = 100.

# auditconfig -getplugin audit_binfile
Plugin: audit_binfile (active)
    Attributes: p_dir=/var/audit;p_fsize=1024000;p_minfree=0;
# auditconfig -setplugin audit_binfile active "p_minfree=2;p_fsize=3072000" 200
# auditconfig -getplugin audit_binfile
Plugin: audit_binfile (active)
    Attributes: p_dir=/var/audit;p_fsize=3072000;p_minfree=2;
    Queue size: 200

The changed specifications go into effect when the administrator refreshes the audit service.

# audit -s

Example 30-15 Removing Queue Size for an Audit Plugin

In the following example, the queue size for the audit_binfile plugin is removed.

# auditconfig -getplugin audit_binfile
Plugin: audit_binfile (active)
    Attributes: p_dir=/var/audit;p_fsize=3072000;p_minfree=2;
    Queue size: 200
# auditconfig -setplugin audit_binfile active "" ""
# auditconfig -getplugin audit_binfile
 Plugin: audit_binfile (active)
    Attributes: p_dir=/var/audit;p_fsize=3072000;p_minfree=2;

The change in qsize specification for the plugin goes into effect when the administrator refreshes the audit service.

# audit -s

Example 30-16 Setting a Soft Limit for Warnings

In this example, the minimum free-space level for all audit file systems is set so that a warning is issued when one percent of the file system is still available.

# auditconfig -setplugin audit_binfile active p_minfree=1

The default percentage is zero (0). For a large ZFS pool, choose a reasonably low percentage. For example, 10 percent of a 16 TB pool is around 16 GBs, which would warn the audit administrator when plenty of disk space remains. A value of 1 sends the audit_warn message when about one GB of disk space remains.

The audit_warn alias receives the warning. To set up the alias, see How to Configure the audit_warn Email Alias.

For a large pool, the administrator also limits the file size to 3GB.

# auditconfig -setplugin audit_binfile active p_fsize=3076000

The p_minfree and p_fsize specifications for the plugin go into effect when the administrator refreshes the audit service.

# audit -s

How to Send Audit Files to a Remote Repository

In this procedure, you use attributes to the audit_remote plugin to send the audit trail to a remote audit repository.

Before You Begin

You must have a receiver of audit files at your remote repository. You must be assigned the Audit Configuration rights profile.

1. Become an administrator with the required security attributes.

   For more information, see How to Obtain Administrative Rights.

2. Determine the attributes to the audit_remote plugin.

   Read the OBJECT ATTRIBUTES section of the audit_remote(5) man page.

   # man audit_remote
   ...
   OBJECT ATTRIBUTES
        The p_hosts attribute specifies the remote servers.
        You can also specify the port number and the GSS-API
        mechanism.
        
        The p_retries attribute specifies the number of retries for
        connecting and sending data. The default is 3.
   
        The p_timeout attribute specifies the number of seconds
        in which a connection times out.

   The default port is the solaris_audit IANA-assigned port, port 16162/tcp. The default mechanism is kerberos-v5. The timeout default is 5 seconds. You can also specify a queue size for the plugin.

3. To specify the remote hosts, use the p_hosts attribute.

   # auditconfig -setplugin audit_remote active p_hosts=rhost1:16088:kerberos_v5

4. To specify the number of retries, use the p_retries attribute.

   # auditconfig -setplugin audit_remote active p_retries=5

5. To specify the length of a connection timeout, use the p_timeout attribute.

   # auditconfig -setplugin audit_remote active p_timeout=3

6. Refresh the audit service.

   The audit service reads the audit plugin change upon refresh.

   # audit -s

How to Configure syslog Audit Logs

You can instruct the audit service to copy some or all of the audit records in the audit queue to syslog. In the following procedure, you save binary audit data and text summaries.

Before You Begin

To configure the audit_syslog plugin, you must be assigned the Audit Configuration rights profile. To configure syslog, you must be in the root role.

1. Assume the root role.
2. Select classes to be sent to the audit_syslog plugin and make the plugin active.

   ---

   Note - These classes must be preselected as either system defaults, or in a user's audit_flags attribute. Records are not collected for a class that is not preselected.

   ---

   # auditconfig -setplugin audit_syslog active p_flags=lo,+as,-ss

3. Add an audit.notice entry to the syslog.conf file.

   The entry includes the location of the log file.

   # cat /etc/syslog.conf
   …
   audit.notice       /var/adm/auditlog

4. Create the log file.

   # touch /var/adm/auditlog

5. Refresh the configuration information for the syslog service.

   # svcadm refresh system/system-log

6. Refresh the audit service.

   The audit service reads the changes to the audit plugin upon refresh.

   # audit -s

7. Regularly archive the syslog log files.

   The audit service can generate extensive output. To manage the logs, see the logadm(1M) man page.

Example 30-17 Specifying Audit Classes for syslog Output

In the following example, the syslog utility collects a subset of the preselected audit classes. The pf class is created in Example 30-10.

# auditconfig -setnaflags lo,na
# auditconfig -setflags lo,ss
# usermod -K audit_flags=pf:no jdoe
# auditconfig -setplugin audit_syslog active p_flags=lo,-na,-ss,+pf

The arguments to the auditconfig command instruct the system to collect all login/logout, non-attributable, and change of system state audit records. The audit_syslog plugin entry instructs the syslog utility to collect only failed logins, failed non-attributable events, and failed changes of system state.

For the jdoe user, the binary audit record includes all uses of a call to the pfexec command. For these events to be available for post-selection, either the audit_binfile or the audit_remote plugin must be active. The syslog utility collects successful calls to the pfexec command.

Example 30-18 Putting syslog Audit Records on a Remote System

You can change the audit.notice entry in the syslog.conf file to point to a remote system. In this example, the name of the local system is example1. The remote system is remote1.

example1 # cat /etc/syslog.conf
…
audit.notice       @remote1

The audit.notice entry in the syslog.conf file on the remote1 system points to the log file.

remote1 # cat /etc/syslog.conf
…
audit.notice       /var/adm/auditlog