Date: Thu, 8 Feb 2007 19:48:55 +0300 From: Stanislav Sedov <stas@FreeBSD.org> To: freebsd-security@FreeBSD.org Cc: rwatson@FreeBSD.org Subject: audit problems Message-ID: <20070208194855.692300fa.stas@FreeBSD.org>
next in thread | raw e-mail | index | archive | help
--Signature=_Thu__8_Feb_2007_19_48_55_+0300_GjJwIEr1V0w+HAdW Content-Type: text/plain; charset=US-ASCII Content-Disposition: inline Content-Transfer-Encoding: 7bit Hi! I'm experiencing some problems configuring audit on 6.2-RELEASE system. It doesn't seem to log anything except login messages. The only thing I've modified in config is the root user specification in audit_users. Now it looks like this: root:lo,ex,fw,fc:no However nor ex, non fw or fc messages doesn't get into the log. Furthermore, deleting lo from audit_users and audit_control doesn't stop login messages logging. Is it possible that some other kernel options interfere with AUDIT (e.g. MAC)? Thanks! -- Stanislav Sedov ST4096-RIPE --Signature=_Thu__8_Feb_2007_19_48_55_+0300_GjJwIEr1V0w+HAdW Content-Type: application/pgp-signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.6 (FreeBSD) iD8DBQFFy1R3K/VZk+smlYERAkCHAJ0RZxXXYWefND/YVd4Gl9nH4eISGgCfSnL1 Fo9oZIR2VDH5wgTn0nSOn20= =s4Ju -----END PGP SIGNATURE----- --Signature=_Thu__8_Feb_2007_19_48_55_+0300_GjJwIEr1V0w+HAdW--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20070208194855.692300fa.stas>