Enterasys Security Information and Event Manager, Configuration Manual

Page: 360 / 426

Configuring DSMs
344 S
UN
S
OLARIS
The bsmconv script enables Solaris Basic Security Mode and starts the auditing
service auditd.
Step 4
Type the following command to open the audit control log for editing:
vi /etc/security/audit_control
Step 5
Edit the audit control file to contain the following information:
dir:/var/audit
flags:lo,ad,ex,-fw,-fc,-fd,-fr
naflags:lo,ad
Step 6
Save the changes to the audit_control file, then reboot the Solaris console to start
auditd.
Step 7
Type the following command to verify auditd has started:
/user/sbin/auditconfig -getcond
If the auditd process is started, the following string is returned:
audit condition = auditing
Step 8
You are now ready to convert the binary Solaris Basic Security Mode logs to a
human-readable log format.
Converting Sun
Solaris BSM Audit
Logs
SIEM cannot process binary files directly from Sun Solaris BSM and must convert
the audit log from the existing binary format to a human-readable log format using
praudit before the audit log data can be retrieved by SIEM.
To convert the Solaris Basic Security Mode logs to a human-readable log format,
perform the following steps:
Step 1
Type the following command to create a new script on your Sun Solaris console:
vi /etc/security/newauditlog.sh
Step 2
Add the following information to the newauditlog.sh script:
#!/bin/bash
#
# newauditlog.sh - Start a new audit file and expire the old
logs
#
AUDIT_EXPIRE=30
AUDIT_DIR="/var/audit"
LOG_DIR="/var/log/"
/usr/sbin/audit -n
cd $AUDIT_DIR # in case it is a link
# Get a listing of the files based on creation date that are not
current in use