AFP548 Changing the world one server at a time.

10.4.1 auditing logs yielding mostly garbage

Home › Forums › OS X Server and Client Discussion › Misc. › 10.4.1 auditing logs yielding mostly garbage

Viewing 2 posts - 1 through 2 (of 2 total)
  • Author
    Posts
  • June 21, 2005 at 5:59 am #362036
    totengraber
    Participant

    -Running 10.4.1 server
    -Installed ComonCriteriaTools for 10.4
    -Added AUDIT=-YES- to /etc/hostconfig
    -Restarted system
    -Checked /var/audit and found running audit log
    -Ran audit -s to terminate current audit, restart audit service, start new audit log
    -Checked terminated audit log via textedit, more command, emacs, etc = around 75% of the text is machine code and is unreadable
    -Checked firewall = off
    -Restarted and ran audit-s again
    -Checked old and newer audit logs = still mostly garbage

    Any suggestions? Is there a utility for the auditing subsystem that allows you to run reports on audit files like the audit_tools in alot of UNIX systems? Anyone have success using the Common Criteria Tools for 10.4 to audit their server, i’m assuming yes, but you never know.

    June 21, 2005 at 11:36 pm #362052
    totengraber
    Participant

    Ahah! Hidden in plain view…

    Thank you, i’ve been scouring the web and have read through the audit section several times in the common criteria tools documentation from Apple, but there is nothing about actually viewing and running reports on audit files.

    Thanks again…
    -j

  • Author
    Posts
Viewing 2 posts - 1 through 2 (of 2 total)
  • You must be logged in to reply to this topic.