Server Fault Stack Exchange
Server Fault Stack Exchange

Questions tagged [audit]

Observing/logging a resource for purposes of: - Adding it to a blacklist of whitelist - Keeping tabs on the security of a system

325 questions
1
vote
1 answer

Recommend tools for auditing/testing MIT Kerberos Passwords

Debian 6 MIT Kerberos i.e. krb5 I want to be able to audit/test the passwords in our Kerberos server periodically for quality. If the passwords can be cracked quickly I want to notify the users to change their passwords etc. I administer the…
caleban
  • 1,116
  • 5
  • 18
  • 34
1
vote
1 answer

SQL Server 2008 Audit Service

I'm designing an application that will run on SQL Server 2008 R2. There's a requirement to audit any updates to a customer table. The new Audit service that was release as part of SQL Server 2008 seemed to be a great fit. Unfortunately, although I…
tr0users
  • 413
  • 3
  • 11
  • 16
1
vote
3 answers

Auditing on UNIX System

I'm working on a project which requires some auditing of read/write/modifications to various files. Additionally I must log ftp access, user logins, NTP/system time changes etc. Is there a nice tool for UNIX able to do all this and also allow me to…
user8680
  • 11
  • 1
1
vote
1 answer

How well does Cocoa allow auditing of I/O to USB, FireWire and optical media on a Mac?

I have a client who wants us to lock down the Mac laptops we're using to access his data. He wants an audit of all files read and written from removable media (USB, FireWire, optical). I have a sister question re: finding a commercial app for…
Christopher DeMarco
  • 41
  • 5
1
vote
2 answers

Are there free secure ways to audit a LAMP's security configs?

Problem is new to LAMP, and want to test the system config in any automated checklist way. Any suggestions?
blunders
  • 813
  • 7
  • 14
  • 30
1
vote
1 answer

Exchange End User Usage Statistics Tools

Anyone know of software/tools used to measure and draw reports based off of end user Exchange usage? Items for a particular user would include: How many messages a day List of top receipts from that user Collective KB/MB sent per day/week Peak…
Malnizzle
  • 1,441
  • 2
  • 16
  • 30
1
vote
3 answers

problem of setting audit rules: Syscall name unknown: stime

I am setting audit rules in /etc/audit/audit.rules. As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions. So I add one line into /etc/audit/auditd.rules: -a exit,always -S stime -S…
zhaojing
  • 195
  • 2
  • 3
  • 11
1
vote
2 answers

Could anyone give me some suggestion about configure secure audit system

I'm new about configure audit system. And I have some tasks such as configure audit system to audit failed attempts to access files and programs. configure audit system to audit files and programs deleted by user... ... I am very confused about the…
zhaojing
  • 195
  • 2
  • 3
  • 11
1
vote
1 answer

What does audit mode in Sysprep do?

Possible Duplicate: Is the audit mode of SYSPREP practically useful in Windows deployment? The MS docs say when you should use it, and for what, but I can't find any description of what going into Audit mode actually does.
askvictor
  • 854
  • 3
  • 15
  • 29
1
vote
7 answers

Audit reserved IPs for UNIX/Linux ISC-DHCP

Are there any good FOSS tools to do an audit of reserved IPs used in a Linux/UNIX ISC DHCPd environment? I'm trying to ensure that we do not have stale IP addresses reserved when old MAC addresses are pulled.
keithosu
  • 336
  • 2
  • 15
1
vote
2 answers

How to track which process is failing logons?

Windows Server 2003, VMWare VirtualCenter 2.5. Something is continuously trying to log on to VirtualCenter using a disabled domain account; the failed logon attempts are logged by VirtualCenter in its own logs and by Windows in the Security event…
Massimo
  • 70,200
  • 57
  • 200
  • 323
1
vote
0 answers

How to set proctitle to ascii in auditd?

I configured auditd to send the logs to SIEM through rsyslog. But when I get those logs the proctitle is in hex. Ex.: <134>Aug 25 17:08:44 vmauditd tag_audit_log: node=vmauditd type=PROCTITLE msg=audit(1692983317.146:7444):…
Sandson Costa
  • 111
  • 1
1
vote
1 answer

trace kubernetes users activities in pods

I want to track users activities in a k8s cluster. for example I want to get k8s username of a user that executes a command in a pod. there is a tool named Tetragon. it can uses k8s api. following log is a sample output from Tetragon on a k8s…
Michael Cab
  • 13
  • 2
1
vote
2 answers

What can you do when auditd halts the system?

I recently had an issue where my server powered off in the middle of running a script, seemingly randomly, but at about the same point each time, and then whenever I tried to power the server on again it would start the start up process and then…
Dave
  • 111
  • 4
1
vote
1 answer

Auditd - Don't log events from salt-minion

I'm updating our Auditd rules (Red Hat Linux) to log all tty/interactive commands from all users. That part works no problem. What I'm trying to do now is to exclude commands issued by our salt-master that are executed on one of our salt-minions. …
Egyas
  • 151
  • 2
  • 10
1 2 3
…
21 22