Novell LINUX ENTERPRISE DESKTOP 11, Руководство пользователя

Страница: 434 / 450

aureport -f -i --failed |grep -e "/etc/audit/auditd.conf" -e
"/etc/pam.d/" -e "/etc/sysconfig"
993. 17/02/09 16:47:34 /etc/sysconfig/displaymanager readlink no
/bin/vim-normal root 7887
994. 17/02/09 16:48:23 /etc/sysconfig/displaymanager getxattr no
/bin/vim-normal root 7889
5 Use the event ID to get a detailed record for each item of interest:
ausearch -a 7887 -i
----
time->Tue Feb 17 16:48:23 2009
type=PATH msg=audit(1234885703.090:7889): item=0
name="/etc/sysconfig/displaymanager" inode=369282 dev=08:06 mode=0100644
ouid=0 ogid=0 rdev=00:00
type=CWD msg=audit(1234885703.090:7889): cwd="/root"
type=SYSCALL msg=audit(1234885703.090:7889): arch=c000003e syscall=191
success=no exit=-61 a0=7e1e20 a1=7f90e4cf9187 a2=7fffed5b57d0 a3=84
items=1 ppid=25548 pid=23045 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0
egid=0 sgid=0 fsgid=0 tty=pts2 ses=1166 comm="vim" exe="/bin/vim-normal"
key=(null)
TIP: Focusing on a Certain Time Frame
If you are interested in events during a particular period of time, trim down
the reports by using start and end dates and times with your
aureport
com-
mands (
-ts
and
-te
). For more information, refer to Section 30.5.2, “Gener-
ating Custom Audit Reports” (page 397).
All steps except for the last one can be run automatically and would easily be scriptable
and configured as cron jobs. Any of the
--failed --summary
reports could be
transformed easily into a bar chart that plots files versus failed access attempts. For
more information about visualizing audit report data, refer to
Section 31.6, “Configuring
Log Visualization” (page 420).
31.6 Configuring Log Visualization
Using the scripts
mkbar
and
mkgraph
you can illustrate your audit statistics with
various graphs and charts. As with any other
aureport
command, the plotting com-
mands are scriptable and can easily be configured to run as cron jobs.
420 Security Guide