I have enabled auditing on hpux 10.20
vim /etc/rc.config.d/auditing
AUDITING=1
PRI_AUDFILE=/.secure/etc/audfile1
PRI_SWITCH=1000
SEC_AUDFILE=/.secure/etc/audfile2
SEC_SWITCH=1000
AUDEVENT_ARGS1="-P -F -e moddac -e login -e admin"
AUDEVENT_ARGS2=""
AUDEVENT_ARGS3=""
AUDOMON_ARGS="-p 20 -t 1 -w 90"
start auditing
audsys -c /.secure/etc/audfile1 -x /.secure/etc/audfile2 -s 1000 -z 1000
i reboot and..
audisp -u root
users and aids:
root
0
All events are selected.
All ttys are selected.
Selecting successful & failed events.
TIME PID E EVENT PPID AID RUID RGID EUID EGID TTY
as you can see no events are reported, why?
Asked by elbarna
(13690 rep)
Nov 18, 2024, 11:18 AM
Last activity: Nov 18, 2024, 11:25 AM
Last activity: Nov 18, 2024, 11:25 AM