Re: [logs] BSm root user data

Previous message: Jason Haar: "Re: [logs] Correlation Whitepaper"
In reply to: Tina Bird: "[logs] BSm root user data"
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

oddbjornat_private

On Thu, May 08, 2003 at 11:07:13PM +0000, Tina Bird wrote:
> anyone out there using solaris BSM? i need a couple of examples of
> records of root user activity, and damned if i can find any data
> anywhere.

Speaking of Solaris BSM -- anybody aware of a tool that listen to
the audit log file, and forwards it to syslog or other destinations
in near real-time?

It could be useful for limiting the time gap of potential modification
that periodic dumps with praudit or rsyncing of the binary files will
leave. While such a tool probably wouldn't be well suited for 'heavy'
auditing, it could work decently for selected audit events.

-oddbjorn
_______________________________________________
LogAnalysis mailing list
LogAnalysisat_private
http://lists.shmoo.com/mailman/listinfo/loganalysis