Novell LINUX ENTERPRISE DESKTOP 11, Руководство пользователя

Страница: 393 / 450

auditctl
The auditctl utility controls the audit system. It controls the log generation param-
eters and kernel settings of the audit interface as well as the rule sets that determine
which events are tracked. For more information about auditctl, refer to
Section 30.3,
“Controlling the Audit System Using auditctl” (page 385).
audit rules
The file
/etc/audit/audit.rules
contains a sequence of auditctl commands
that are loaded at system boot time immediately after the audit daemon is started.
For more information about audit rules, refer to
Section 30.4, “Passing Parameters
to the Audit System” (page 387).
aureport
The aureport utility allows you to create custom reports from the audit event log.
This report generation can easily be scripted and the output can be used by various
other applications, for example, to plot these results. For more information about
aureport, refer to
Section 30.5, “Understanding the Audit Logs and Generating
Reports” (page 391).
ausearch
The ausearch utility can search the audit log file for certain events using various
keys or other characteristics of the logged format. For more information about
ausearch, refer to
Section 30.6, “Querying the Audit Daemon Logs with ausearch”
(page 403).
audispd
The audit dispatcher daemon (audispd) can be used to relay event notifications to
other applications instead of or in addition to writing them to disk in the audit log.
autrace
The autrace utility traces individual processes in a fashion similar to strace. The
output of
autrace
is logged to the audit log. For more information about autrace,
refer to Section 30.7, “Analyzing Processes with autrace” (page 407).
30.2 Configuring the Audit Daemon
Before you can actually start generating audit logs and process them, configure the
audit daemon itself. Configure how it is started in the
/etc/sysconfig/auditd
Understanding Linux Audit 379