Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 437 / 450

32
Introducing an Audit Rule Set
The following example configuration illustrates how audit can be used to monitor your
system. It highlights the most important items that need to be audited to cover the list
of auditable events specified by Controlled Access Protection Profile (CAPP).
The example rule set is divided into the following sections:
• Basic audit configuration (see Section 32.1, “Adding Basic Audit Configuration
Parameters” (page 424))
• Watches on audit log files and configuration files (see Section 32.2, “Adding
Watches on Audit Log Files and Configuration Files” (page 425))
• Monitoring operations on file system objects (see Section 32.3, “Monitoring File
System Objects” (page 426))
• Monitoring security databases (see Section 32.4, “Monitoring Security Configuration
Files and Databases” (page 427))
• Monitoring miscellaneous system calls ( Section 32.5, “Monitoring Miscellaneous
System Calls” (page 430))
• Filtering system call arguments (see Section 32.6, “Filtering System Call Argu-
ments” (page 430))
Introducing an Audit Rule Set 423