Originally posted by: SystemAdmin

HI
I wanted to know the procedure to audit ( to log) only the read events on a particular file. I don't want the audit system to log any other events other than this.
please specify me the changes I have to make in the object, config , evnets file for this

thanx in advance
#AIX-Forum

Originally posted by: SystemAdmin

The file you're looking for is /etc/security/audit/objects. It contains stanza entries as follows:

/full/path/of/file/i/want/to/audit:
r = "name to describe reading this file"

Just add entries as appropriate, restart the audit daemon and you should be in business.

HTH

Jim Lane
#AIX-Forum

Originally posted by: usrb

That's ok, but if I want to audit only and nothing but this read action on that object and have only one stanza for some human user e.g. user in /etc/security/audit/config, it still audits ALL events done with user root.
You can see that while audit is running with command audit query.
Do you know how to disable class ALL?
#AIX-Forum

Originally posted by: SystemAdmin

Hi, You can try like this.

1) Just keep the filename which you want to get audited in /etc/security/audit/objects file (remove any other lines from the objects file, if you have)

/etc/logfile:
r = "FILE_read"

2) In the classes section of /etc/security/audit/config file, add this:

custom = FILE_read

3) In the users section of the /etc/security/audit/config file, have
just this:

default = custom

Once after this restart the audit subsystem and verify it.
#AIX-Forum

Originally posted by: usrb

Great ibm56aix, thank you!
#AIX-Forum

Originally posted by: zstarsales04

Zstar Electronic Co.Ltd, Sell fire cards for DS/NDSL/NDSi, also have Wii, DSiLL, NDSi, NDSL, PSP2000, PSP3000, PS2, PS3, PSP go, PSP, Xbox360 accessories, all kinds of phones are available
www.zstar.hk
#AIX-Forum