Novell LINUX ENTERPRISE DESKTOP 11, Manual, Page: 425 / 450

31
Setting Up the Linux Audit
Framework
This chapter shows how to set up a simple audit scenario. Every step involved in con-
figuring and enabling audit is explained in detail. After you have learned to set up audit,
consider a real-world example scenario in
Chapter 32, Introducing an Audit Rule Set
(page 423).
To set up audit on SUSE Linux Enterprise Server, you need to complete the following
steps:
Procedure 31.1 Setting Up the Linux Audit Framework
1
Make sure that all required packages are installed:
audit
,
audit-libs
, and
optionally
audit-libs-python
. To use the log visualization as described
in Section 31.6, “Configuring Log Visualization” (page 420), install
gnuplot
and
graphviz
from the SUSE Linux Enterprise Server media.
2 Determine the components to audit. Refer to Section 31.1, “Determining the
Components to Audit” (page 412) for details.
3 Check or modify the basic audit daemon configuration. Refer to Section 31.2,
“Configuring the Audit Daemon” (page 413) for details.
4
Enable auditing for system calls. Refer to Section 31.3, “Enabling Audit for
System Calls” (page 414) for details.
5 Compose audit rules to suit your scenario. Refer to Section 31.4, “Setting Up
Audit Rules” (page 415) for details.
Setting Up the Linux Audit Framework 411