Chronological audit logs

Chronological audit logs

[Kirkwood, David A]

[-- Attachment #1.1: Type: text/plain, Size: 598 bytes --]

Can someone tell me how I can generate a chronological listing between 2
dates of all the issues

I have designated to watch in the audit capabilities of the system? I
need to get a system with audit

capability sufficiently palatable to the Defense Department for
classified use. I currently use Sun

workstations and generate the audit logs via praudit and was looking for
some way to set up simaller

archived weekly audit logs.

 

Thanks,

 

David A. Kirkwood
SAIC

david.a.kirkwood@saic.com
kirkwoodd@saic.com

Phone: (727) 502-8310
Fax:   (727) 822-7776 

 


[-- Attachment #1.2: Type: text/html, Size: 3253 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Chronological audit logs

[Stephen Smalley]

On Tue, 2006-11-28 at 16:06 -0500, Kirkwood, David A wrote:
> Can someone tell me how I can generate a chronological listing between
> 2 dates of all the issues
> 
> I have designated to watch in the audit capabilities of the system?

/sbin/ausearch -i -ts "starting date" -te "ending date"

And of course you can use the other options of ausearch to refine that
listing as desired.

>  I need to get a system with audit
> 
> capability sufficiently palatable to the Defense Department for
> classified use. I currently use Sun
> 
> workstations and generate the audit logs via praudit and was looking
> for some way to set up simaller
> 
> archived weekly audit logs.

-- 
Stephen Smalley
National Security Agency

Re: Chronological audit logs

[Steve Grubb]

On Tuesday 28 November 2006 16:06, Kirkwood, David A wrote:
> Can someone tell me how I can generate a chronological listing between 2
> dates of all the issues I have designated to watch in the audit capabilities
> of the system? 

ausearch -ts date1 -te date2

> I currently use Sun workstations and generate the audit logs via praudit and
> was looking for some way to set up simaller archived weekly audit logs.

You would need to setup a cron job to do the weekly rotation if that is what 
you want. There is a sample cron script, auditd.cron, that you can use as a 
starting point. The normal rotation is by size in order to fit more data onto 
your drives.

-Steve