Dell InTrust Preparing for Auditing and Monitoring IBM AIX

Transcription

1 Dell InTrust 11.1 Preparing fr Auditing and Mnitring IBM AIX

2 2015 Dell Inc. ALL RIGHTS RESERVED. This guide cntains prprietary infrmatin prtected by cpyright. The sftware described in this guide is furnished under a sftware license r nndisclsure agreement. This sftware may be used r cpied nly in accrdance with the terms f the applicable agreement. N part f this guide may be reprduced r transmitted in any frm r by any means, electrnic r mechanical, including phtcpying and recrding fr any purpse ther than the purchaser s persnal use withut the written permissin f Dell Sftware Inc. The infrmatin in this dcument is prvided in cnnectin with Dell Sftware prducts. N license, express r implied, by estppel r therwise, t any intellectual prperty right is granted by this dcument r in cnnectin with the sale f Dell Sftware prducts. EXCEPT AS SET FORTH IN DELL SOFTWARE S TERMS AND CONDITIONS AS SPECIFIED IN THE LICENSE AGREEMENT FOR THIS PRODUCT, DELL SOFTWARE ASSUMES NO LIABILITY WHATSOEVER AND DISCLAIMS ANY EXPRESS, IMPLIED OR STATUTORY WARRANTY RELATING TO ITS PRODUCTS INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT. IN NO EVENT SHALL DELL BE LIABLE FOR ANY DIRECT, INDIRECT, CONSEQUENTIAL, PUNITIVE, SPECIAL OR INCIDENTAL DAMAGES (INCLUDING, WITHOUT LIMITATION, DAMAGES FOR LOSS OF PROFITS, BUSINESS INTERRUPTION OR LOSS OF INFORMATION) ARISING OUT OF THE USE OR INABILITY TO USE THIS DOCUMENT, EVEN IF DELL SOFTWARE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. Dell Sftware makes n representatins r warranties with respect t the accuracy r cmpleteness f the cntents f this dcument and reserves the right t make changes t specificatins and prduct descriptins at any time withut ntice. Dell Sftware des nt make any cmmitment t update the infrmatin cntained in this dcument. If yu have any questins regarding yur ptential use f this material, cntact: Dell Sftware Inc. Attn: LEGAL Dept 5 Plaris Way Alis Viej, CA Refer t ur web site ( fr reginal and internatinal ffice infrmatin. Trademarks Dell and the Dell lg are trademarks f Dell Inc.and/r its affiliates. Other trademarks and trade names may be used in this dcument t refer t either the entities claiming the marks and names r their prducts. Dell disclaims any prprietary interest in the marks and names f thers. Legend CAUTION: A CAUTION icn indicates ptential damage t hardware r lss f data if instructins are nt fllwed. WARNING: A WARNING icn indicates a ptential fr prperty damage, persnal injury, r death. IMPORTANT NOTE, NOTE, TIP, MOBILE, r VIDEO: An infrmatin icn indicates supprting infrmatin. Dell InTrust Preparing fr Auditing and Mnitring IBM AIX Updated - Octber 2015 Sftware Versin

3 Cntents IBM AIX Auditing and Real-Time Mnitring Overview 4 Setup 5 Requirements 5 Installatin 5 Getting Started 8 Agent Setup 8 Cnfiguring Syslg 8 Cnfiguring AIX Audit Lg 8 Editing Audit Lg Cnfiguratin Files 9 InTrust Cnfiguratin 11 Data Surces 11 AIX Syslg 11 AIX Audit Lg 13 Text File-Mnitring Data Surces 14 Script Event Prvider Data Surces 15 Auditing, Reprting, and Real-Time Mnitring 16 InTrust Cnfiguratin 17 Data Surces 17 AIX Syslg 17 AIX Audit Lg 19 Text File-Mnitring Data Surces 20 Script Event Prvider Data Surces 21 Use Scenaris 22 Syslg Cnfiguratin Mnitring 22 Tracking Security Incidents 22 Audit Lg Event Frmat 23 Abut Dell 25 Cntacting Dell Inc. 25 Technical supprt resurces 25 Preparing fr Auditing and Mnitring IBM AIX 3

4 IBM AIX Auditing and Real-Time Mnitring Overview The IBM AIX Knwledge Pack expands the auditing and reprting capabilities f Dell InTrust t IBM AIX. The Knwledge Pack enables InTrust t wrk with IBM AIX Syslg, text lgs, and Audit lg. The fllwing table shws what yu can audit and mnitr n AIX: Data surce Gathering Real-Time Mnitring Syslg messages Yes Yes Text lgs f any frmat Yes N Cnfiguratin file mdificatin Yes Yes AIX audit lgs Yes N Preparing fr Auditing and Mnitring IBM AIX 4

5 Setup Requirements Installatin Requirements The InTrust Knwledge Pack fr IBM AIX is cmpatible with the fllwing IBM AIX versins: V7.1 V6 V5.3 TL r later IBM C++ Runtime Envirnment Cmpnents fr AIX (versin r later) must be installed n the AIX cmputers where yu want t set up InTrust agents. This sftware is available frm the IBM Web site at Installatin T enable AIX supprt in InTrust, the AIX Knwledge Pack must be installed n the InTrust server. The Knwledge Pack is installed as part f the main InTrust installatin. The fllwing bjects are included: Data surces: AIX Audit Lg AIX Syslg AIX Accunts Mnitring AIX Text Files Mnitring Gathering plicies: AIX: Cmmn Security Events AIX: All Syslg Messages AIX: Accunts mnitring AIX: Text files mnitring AIX: All Events frm Audit Lg AIX: filesystem events frm Audit Lg AIX: lgins/lguts frm Audit Lg Preparing fr Auditing and Mnitring IBM AIX 5

6 AIX: prcess executin events frm Audit Lg AIX: system bject events frm Audit Lg Imprt plicies: AIX: Cmmn Security Events AIX: All Syslg Messages AIX: Accunts mnitring AIX: Text files mnitring AIX: All Events frm Audit Lg AIX: filesystem events frm Audit Lg AIX: lgins/lguts frm Audit Lg AIX: prcess executin events frm Audit Lg AIX: system bject events frm Audit Lg Cnslidatin plicies: AIX lgs cnslidatin AIX lgs cnslidatin fr the last mnth Tasks: AIX lgs daily cllectin AIX cnfiguratin changes daily cllectin AIX weekly reprting AIX hsts site AIX: security real-time mnitring plicy Reprts: AIX lgin statistics AIX successful lgins AIX su activity AIX failed lgin attempts AIX multiple failed lgin attempts All AIX syslg events AIX User management AIX Grup management AIX Grup membership management AIX Cnfiguratin files mdificatins AIX File Permissin Changes AIX Passwrd Changes AIX Rebts Preparing fr Auditing and Mnitring IBM AIX 6

7 Rules: su rt succeeded Multiple failed lgins Lgin authenticatin failed Failed su attempt Successful lgin by rt User accunt created User accunt remved Grup created Grup remved User added t the grup User remved frm the grup Syslg.cnf file mdified Text file mdified T install the Knwledge Pack, launch its setup package n the InTrust server. Preparing fr Auditing and Mnitring IBM AIX 7

8 Getting Started The related tpics explain the steps yu need t take t set up AIX auditing and mnitring, as fllws: 1. Install the InTrust agent n each AIX hst. 2. Adjust the cnfiguratin f Syslg, if necessary. 3. Cmplete the cnfiguratin in InTrust Manager. Agent Setup Fr detailed instructins, see Installing Agents Manually. Cnfiguring Syslg Syslg is an imprtant lgging facility in AIX. Syslg functinality is prvided by the syslgd daemn, which accepts messages frm varius surces that supprt lgging, and either writes these messages t files r passes them n t ther hsts in the netwrk. The syslg.cnf file specifies where syslgd sends a message depending n the parameters f the message. Fr a detailed descriptin f this file's frmat, see the syslg.cnf man page. When yu install the InTrust agent n the AIX hst, the necessary entries are autmatically added t syslg.cnf. Yu d nt have t mdify any message redirectin settings manually. Hwever, as lng as yu d nt mdify InTrust-related settings, it is up t yu hw yu cnfigure redirectin f messages t ther destinatins. Cnfiguring AIX Audit Lg The AIX audit system prvides lgging capability and handles system events in the fllwing tw ways: Writes event recrds t lg files in "bin mde" Redirects messages t the specified destinatin in "stream mde" The InTrust agent n the AIX cmputer relies n stream mde fr event recrds. Auditing starts accrding t audit system settings, including the fllwing: Accunts t be audited Types f events t be audited fr thse accunts Preparing fr Auditing and Mnitring IBM AIX 8

9 If yur auditing is already cnfigured the way yu need, then yu d nt need t d any further cnfiguratin. Hwever, yu might still need t cnfigure r adjust the audit settings, as described in the related tpics. In this case yu primarily need t edit the tw settings listed abve. Editing Audit Lg Cnfiguratin Files AIX audit uses the settings in the fllwing files: /etc/security/audit/cnfig /etc/security/audit/events /etc/security/audit/bjects /etc/security/audit/bincmds /etc/security/audit/streamcmds This sectin briefly describes nly settings that specify auditable accunts and events. Fr detailed infrmatin abut these and ther settings, refer t the audit system man pages (man audit) and the Accunting and Auditing n AIX 5L IBM Red Bk. The settings in questin are cnfigured in the /etc/security/audit/cnfig file. If yu did nt enable system audit cmpatibility with the agent during setup, take the fllwing additinal steps t enable the InTrust agent t capture Audit lg events: 1. 1 In the start stanza f the file, set the streammde ptin t n: streammde = n 2. 2 In the streams stanza, set the cmds ptin t the<agent_installatin_ directry>/intruststreamcmds file, which was created during setup. Fr example: cmds = /exprt/hme/1604/intruststreamcmds The /etc/security/audit/cnfig file als includes definitins f audit classes and assignments f thse classes t individual user accunts. This part f the file lks similar t the fllwing:... classes: general=user_su,password_change,file_unlink,file_link,file_rename,fs_chdir,fs_ Chrt,PORT_Lcked,PORT_Change,FS_Mkdir,FS_Rmdir bjects=s_environ_write,s_group_write,s_limits_write,s_login_write,s_passwd_read,s_ PASSWD_WRITE,S_USER_WRITE,AUD_CONFIG_WR... users: rt = general,bjects,kernel,files... Auditing is cnfigured n a per-user basis. Each audited accunt is assigned an audit class, which is a gruping f auditable event types. Audit classes are defined in the classes stanza and assciated with individual users in the users stanza. Preparing fr Auditing and Mnitring IBM AIX 9

10 Yu can use default AIX audit class presets, r define yur wn classes, and assciate them with the users whse activity yu want t audit. Fr details n event syntax and any ther cnfiguratin ptins, refer t AIX dcumentatin. After editing the /etc/security/audit/cnfig file, restart system audit. Preparing fr Auditing and Mnitring IBM AIX 10

11 InTrust Cnfiguratin After yu have taken all the necessary cnfiguratin steps n the target AIX hsts, the InTrust Manager snap-in takes ver all auditing and real-time mnitring peratins. This sectin describes AIX-specific settings that are nt explained in the ther InTrust dcumentatin. Data Surces The AIX Syslg and AIX Audit Lg data surces represent the AIX audit trails. The "AIX Text Files Mnitring" and AIX Accunts Mnitring data surces wrk with files that are nt audit trails. AIX Syslg AIX Audit Lg Text File-Mnitring Data Surces Script Event Prvider Data Surces AIX Syslg Syslg auditing and real-time mnitring is based n the flw f data intended fr the syslgd daemn. The AIX Syslg data surce is used t analyze the data flw and capture nly the necessary prtins f it. This data surce uses a list f regular expressins. When the data surce is wrking, it applies the expressins, in the rder specified, t each message. The rder f the regular expressins matters because message prcessing stps as sn as the message matches ne f the expressins. When parsing takes place, pairs f parentheses are used in regular expressins t break messages up int numbered fields. Fr example, the fllwing regular expressin: ^(.{15}) ([-[:alnum:]_.]+) (su)(\[[0-9]*\]){0,1}: \[ID ([0-9]+) [a-z]+\.[a-z]+\] ('su (.*)' succeeded fr (.*) n (.*)) matches the fllwing message: Dec 16 07:29:28 r5 su: [ID auth.ntice] 'su rt' succeeded fr jsmith n /dev/pts/1 The result is an event with the fllwing fields: Field Name Field Number Field Cntents Cmputer <2> r5 Descriptin <6> su rt succeeded fr jsmith n /dev/pts/1 Event ID <5> Event Surce <3> su Preparing fr Auditing and Mnitring IBM AIX 11

12 Field Name Field Number Field Cntents Insertin String #1 <6> su rt succeeded fr jsmith n /dev/pts/1 Insertin String #11 <7> rt Insertin String #12 <8> jsmith The last regular expressin in the predefined data surce is designed t match any message. This ensures that the message is nt lst. The result f this regular expressin is an event where the Descriptin and Insertin String #1 fields bth cntain the descriptive part f the message, if a descriptive part is present. It is nt recmmended that yu mdify predefined regular expressins in the data surce. These expressins are required fr the reprts that cme with the AIX Knwledge Pack. These reprts will ignre any data resulting frm the use f custm regular expressins. If yu create a custm Syslg data surce with yur wn regular expressins, make sure yu use custmized reprts based n the data that these regular expressins help capture. CAUTION: Including a lt f cmplex regular expressins in the data surce may slw dwn Syslg prcessing significantly. Preparing fr Auditing and Mnitring IBM AIX 12

13 AIX Audit Lg In InTrust Manager, the AIX Audit lg is represented by the AIX Audit Lg data surce. Use this data surce in any gathering, cnslidatin and imprt plicies that need t wrk with Audit lg data. In additin t native Audit lg events, the InTrust agent writes the fllwing tw events: Event ID Meaning The InTrust agent detected that AIX system audit had been stpped The InTrust agent detected that AIX system audit had been started (either befre r after the start f the agent itself) Fr infrmatin abut the frmat f the resulting event recrds, see Audit Lg Event Frmat. Preparing fr Auditing and Mnitring IBM AIX 13

14 Text File-Mnitring Data Surces The AIX Accunts Mnitring and AIX Text Files Mnitring scripted data surces are designed t parse specified files. Real-time mnitring rules use these data surces t mnitr the files fr changes. CAUTION: These scripted data surces are nt designed fr general-purpse auditing and mnitring f text-based lgs. They shuld be used nly n cnfiguratin files that preferably d nt exceed 100 kilbytes. T cllect large text-based lgs, use Custm Text Lg Events data surces, as described in the Auditing Custm Lgs with InTrust. T specify the file paths, edit the apprpriate parameters f the data surces. Fr example, t mnitr the /etc/hsts.allw and /etc/hsts.deny files, take the fllwing steps: 1. Open the prperties f the AIX Text Files Mnitring data surce. 2. On the Parameters tab, select the TextFiles parameter and click Edit. 3. Supply /etc/hsts.allw and /etc/hsts.deny in the dialg bx that appears. Similarly, yu can edit the UsersFile and GrupsFile parameters f the AIX accunts mnitring data surce if the lcatin f the passwd and grups files differs frm the default n yur AIX hsts. NOTE: Mnitring the passwd and grups files makes sense if yur AIX envirnment des nt use a directry slutin. With a directry in place, infrmatin in these files is nt imprtant r representative. Preparing fr Auditing and Mnitring IBM AIX 14

15 Script Event Prvider Data Surces InTrust prvides an additinal ptin t create a custm data surce using the Script Event Prvider. This functinality allws t create a script that starts with pre-set frequency. Under sme cnditins that are specified in this script events are generated and then are passed t the InTrust agent. Events are stred in the agent's backup cache. Frm there, the events can be captured by the gathering r real-time mnitring engine. Yu can specify in the certain script: what infrmatin is stred and hw it is rdered in the certain events, what cnditins are required fr event generatin. T create a custm data surce with Script Event Prvider 1. Right-click the Cnfiguratin Data Surces nde and select New Data Surce. 2. In the New Data Surce Wizard, select the Script Event Prvider data surce type. 3. On the Script step select the script language and enter yur script text using XML editr. 4. On the same step specify a frequency f the script running. 5. Cmplete the remaining steps. Preparing fr Auditing and Mnitring IBM AIX 15

16 Auditing, Reprting, and Real-Time Mnitring AIX auditing, reprting, and real-time mnitring is similar t wrking with any ther system supprted by InTrust. There is nly ne imprtant difference that refers t active scheduling f the InTrust tasks. Fr infrmatin see the warning nte belw. CAUTION: An active schedule is required t make the agent cache events. If the schedule is disabled, n events are stred. Since all data surces described abve use event caching, it is recmmended that yu use at least ne task fr the data surces that run regularly. If yu want t gather data nly n demand, yu must still enable the schedule fr yur task r tasks, but set it t a pint in the future r in the past. The ther AIX auditing, reprting and real-time mnitring peratins d nt have special requirements, and yu can perfrm them as described in the Auditing Guide and Real-Time Mnitring Guide. Preparing fr Auditing and Mnitring IBM AIX 16

17 InTrust Cnfiguratin After yu have taken all the necessary cnfiguratin steps n the target AIX hsts, the InTrust Manager snap-in takes ver all auditing and real-time mnitring peratins. This sectin describes AIX-specific settings that are nt explained in the ther InTrust dcumentatin. Data Surces The AIX Syslg and AIX Audit Lg data surces represent the AIX audit trails. The "AIX Text Files Mnitring" and AIX Accunts Mnitring data surces wrk with files that are nt audit trails. AIX Syslg AIX Audit Lg Text File-Mnitring Data Surces Script Event Prvider Data Surces AIX Syslg Syslg auditing and real-time mnitring is based n the flw f data intended fr the syslgd daemn. The AIX Syslg data surce is used t analyze the data flw and capture nly the necessary prtins f it. This data surce uses a list f regular expressins. When the data surce is wrking, it applies the expressins, in the rder specified, t each message. The rder f the regular expressins matters because message prcessing stps as sn as the message matches ne f the expressins. When parsing takes place, pairs f parentheses are used in regular expressins t break messages up int numbered fields. Fr example, the fllwing regular expressin: ^(.{15}) ([-[:alnum:]_.]+) (su)(\[[0-9]*\]){0,1}: \[ID ([0-9]+) [a-z]+\.[a-z]+\] ('su (.*)' succeeded fr (.*) n (.*)) matches the fllwing message: Dec 16 07:29:28 r5 su: [ID auth.ntice] 'su rt' succeeded fr jsmith n /dev/pts/1 The result is an event with the fllwing fields: Field Name Field Number Field Cntents Cmputer <2> r5 Preparing fr Auditing and Mnitring IBM AIX 17

18 Field Name Field Number Field Cntents Descriptin <6> su rt succeeded fr jsmith n /dev/pts/1 Event ID <5> Event Surce <3> su Insertin String #1 <6> su rt succeeded fr jsmith n /dev/pts/1 Insertin String #11 <7> rt Insertin String #12 <8> jsmith The last regular expressin in the predefined data surce is designed t match any message. This ensures that the message is nt lst. The result f this regular expressin is an event where the Descriptin and Insertin String #1 fields bth cntain the descriptive part f the message, if a descriptive part is present. It is nt recmmended that yu mdify predefined regular expressins in the data surce. These expressins are required fr the reprts that cme with the AIX Knwledge Pack. These reprts will ignre any data resulting frm the use f custm regular expressins. If yu create a custm Syslg data surce with yur wn regular expressins, make sure yu use custmized reprts based n the data that these regular expressins help capture. CAUTION: Including a lt f cmplex regular expressins in the data surce may slw dwn Syslg prcessing significantly. Preparing fr Auditing and Mnitring IBM AIX 18

19 AIX Audit Lg In InTrust Manager, the AIX Audit lg is represented by the AIX Audit Lg data surce. Use this data surce in any gathering, cnslidatin and imprt plicies that need t wrk with Audit lg data. In additin t native Audit lg events, the InTrust agent writes the fllwing tw events: Event ID Meaning The InTrust agent detected that AIX system audit had been stpped The InTrust agent detected that AIX system audit had been started (either befre r after the start f the agent itself) Fr infrmatin abut the frmat f the resulting event recrds, see Audit Lg Event Frmat. Preparing fr Auditing and Mnitring IBM AIX 19

20 Text File-Mnitring Data Surces The AIX Accunts Mnitring and AIX Text Files Mnitring scripted data surces are designed t parse specified files. Real-time mnitring rules use these data surces t mnitr the files fr changes. CAUTION: These scripted data surces are nt designed fr general-purpse auditing and mnitring f text-based lgs. They shuld be used nly n cnfiguratin files that preferably d nt exceed 100 kilbytes. T cllect large text-based lgs, use Custm Text Lg Events data surces, as described in the Auditing Custm Lgs with InTrust. T specify the file paths, edit the apprpriate parameters f the data surces. Fr example, t mnitr the /etc/hsts.allw and /etc/hsts.deny files, take the fllwing steps: 1. Open the prperties f the AIX Text Files Mnitring data surce. 2. On the Parameters tab, select the TextFiles parameter and click Edit. 3. Supply /etc/hsts.allw and /etc/hsts.deny in the dialg bx that appears. Similarly, yu can edit the UsersFile and GrupsFile parameters f the AIX accunts mnitring data surce if the lcatin f the passwd and grups files differs frm the default n yur AIX hsts. NOTE: Mnitring the passwd and grups files makes sense if yur AIX envirnment des nt use a directry slutin. With a directry in place, infrmatin in these files is nt imprtant r representative. Preparing fr Auditing and Mnitring IBM AIX 20

21 Script Event Prvider Data Surces InTrust prvides an additinal ptin t create a custm data surce using the Script Event Prvider. This functinality allws t create a script that starts with pre-set frequency. Under sme cnditins that are specified in this script events are generated and then are passed t the InTrust agent. Events are stred in the agent's backup cache. Frm there, the events can be captured by the gathering r real-time mnitring engine. Yu can specify in the certain script: what infrmatin is stred and hw it is rdered in the certain events, what cnditins are required fr event generatin. T create a custm data surce with Script Event Prvider 1. Right-click the Cnfiguratin Data Surces nde and select New Data Surce. 2. In the New Data Surce Wizard, select the Script Event Prvider data surce type. 3. On the Script step select the script language and enter yur script text using XML editr. 4. On the same step specify a frequency f the script running. 5. Cmplete the remaining steps. Preparing fr Auditing and Mnitring IBM AIX 21

22 Use Scenaris This sectin describes typical situatins in a prductin envirnment and utlines hw InTrust helps handle them. Fr infrmatin abut specific prcedures, such as creating tasks and jbs r activating rules, see the InTrust Auditing Guide. Syslg Cnfiguratin Mnitring Tracking Security Incidents Syslg Cnfiguratin Mnitring Suppse yu use a finely-tuned Syslg audit plicy in yur envirnment. Yur audit cnfiguratin has prven efficient and reliable, and yu d nt want anyne but a few trusted administratrs t be able t change it. Even s, yu want t knw immediately if the audit plicy is mdified in any way. Use InTrust real-time mnitring capabilities t enable immediate ntificatin. Syslg audit cnfiguratin is defined in the syslg.cnf file, s the slutin in this case is t mnitr this file with InTrust and send an alert whenever the file is mdified. Enable the Syslg.cnf file mdified rule and supply the apprpriate file paths as the rule's parameter. Tracking Security Incidents Yu want t receive daily infrmatin abut pssible security issues in yur envirnment, such as brute frce attack attempts. Yu can achieve this by scheduling gathering and reprting jbs with InTrust. Take the fllwing steps: 1. Make sure that syslgd is running. 2. Create an InTrust task that gathers Syslg events frm the apprpriate site (gathering jb) and builds reprts based n the gathered data (reprting jb).the resulting reprts are stred in the lcal flder that is specified during InTrust installatin (fr details, see the Specifying reprting settings sectin in the Installing the First Server in InTrust Organizatin tpic in the Deplyment Guide). 3. A gd reprt fr this scenari is AIX Multiple failed lgin attempts. 4. It is up t yu whether yu want t stre the gathered data in an InTrust repsitry. Yu can als include a ntificatin jb t get ntified f task cmpletin. 5. Schedule the task t run every mrning at a cnvenient time. Preparing fr Auditing and Mnitring IBM AIX 22

23 Audit Lg Event Frmat This sectin describes the frmat t which the InTrust agent cnverts the Audit lg trails it receives. A typical Audit lg trail is like this: Wed Jun 20 15:37: FS_Mkdir jsmith OK smbd rt C8967E4C mde: 755 dir: tmp/data Frm these trails, the agent prduces event recrds fr the audit database. Each event recrd has a fixed number f fields, which are described in the fllwing table. These fields are always present, even if their values are empty. Field PrviderName Pririty LcalTime GMT DataSurceName HstName DataSurceId Insertin String 1 Insertin String 2 Insertin String 3 Insertin String 4 Insertin String 5 Insertin String 6 Insertin String 7 Insertin String 8 Insertin String 9 Insertin String 10 Details Fr all events, the value f this field is empty. Fr all events, the value f this field is 2, meaning Nrmal. The lcal time f the event. The time f the event represented in GMT frmat. Fr all events, the value f this field is "AIX 5L Audit Lg". The name f the AIX hst where the InTrust agent captured the event. InTrust's internal ID f the agent's AIX auditing engine. Fr all events, the value f this field is "{B0CAB4B0-F676-4E2A-A345-A D8FC}" Event name such as FS_Rmdir, FILE_Unlink and s n. User accunt under which the prgram ran. This may nt be the same as the user accunt that pened the lgin sessin. Auditing status accrding t system audit. Name f the prgram that caused the event. Fr events and 60001, the value is "InTrust cllectr fr AIX audit lg". User accunt that first pened the lgin sessin. In the curse f the sessin, the accunt may have been substituted. Prcess ID f the prgram that caused the event. Prcess ID f the prgram's parent prcess. Thread ID f the prgram that caused the event. CPU ID used by the prgram. Same as Insertin String 2. Preparing fr Auditing and Mnitring IBM AIX 23

24 Field Insertin String 11 Insertin String 12 Descriptin Details Same as Insertin String 5. The frmatted but unmdified cntents f the audit trail. Events and prvide their wn descriptins. Fr ther events, the value is the same as Insertin String 12. UserName Same as Insertin String 5. Categry Same as Insertin String 1. Surce Same as Insertin String 4. TimeGenerated TimeWritten EventType Event generatin time in GMT frmat. Event recrd time in GMT frmat. Fr event 60000, the value f this field is 2, meaning Warning. Fr all ther events, the value is 4, meaning Infrmatin. EventID Can be 0, r Fr all native Audit lg events, the value f this field is 0. Events with the IDs and are nt native events. They are generated by the agent when it detects system audit stp and start, respectively. PlatfrmID The ID f the AIX platfrm; 640 fr all events. Preparing fr Auditing and Mnitring IBM AIX 24

25 Abut Dell Dell listens t custmers and delivers wrldwide innvative technlgy, business slutins and services they trust and value. Fr mre infrmatin, visit Cntacting Dell Inc. Technical Supprt: Online Supprt Prduct Questins and Sales: (800) inf@sftware.dell.cm Technical supprt resurces Technical supprt is available t custmers wh have purchased Dell sftware with a valid maintenance cntract and t custmers wh have trial versins. T access the Supprt Prtal, g t The Supprt Prtal prvides self-help tls yu can use t slve prblems quickly and independently, 24 hurs a day, 365 days a year. In additin, the prtal prvides direct access t prduct supprt engineers thrugh an nline Service Request system. The site enables yu t: Create, update, and manage Service Requests (cases) View Knwledge Base articles Obtain prduct ntificatins Dwnlad sftware. Fr trial sftware, g t Trial Dwnlads. View hw-t vides Engage in cmmunity discussins Chat with a supprt engineer Preparing fr Auditing and Mnitring IBM AIX 25