Novell LINUX ENTERPRISE DESKTOP 11, Руководство пользователя

Страница: 436 / 450

To illustrate the relationship between different kinds of audit objects, such as users and
system calls, use the script
mkgraph
. Some example commands could look like the
following:
Users versus Executables
LC_ALL=C aureport -u -i | awk '/^[0-9]/ { print $4" "$7 }' | sort | uniq
| mkgraph users_vs_exec
Users versus Files
LC_ALL=C aureport -f -i | awk '/^[0-9]/ { print $8" "$4 }' | sort | uniq
| mkgraph users_vs_files
System Calls versus Commands
LC_ALL=C aureport -s -i | awk '/^[0-9]/ { print $4" "$6 }' | sort | uniq
| mkgraph syscall_vs_com
System Calls versus Files
LC_ALL=C aureport -s -i | awk '/^[0-9]/ { print $5" "$4 }' | sort | uniq
| mkgraph | syscall_vs_file
Graphs can also be combined to illustrate complex relationships. See the comments in
the
mkgraph
script for further information and an example. The graphs produced by
this script are created in PostScript format by default, but you can change the output
format by changing the
EXT
variable in the script from
ps
to
png
or
jpg
. To cover a
certain period of time only, use the
-ts
and
-te
options on aureport.
422 Security Guide