IDS Forum

Re: IDS 10.00.FC11 on Sun 5.10 - Informix audi....

Posted By: Roger Kee
Date: Wednesday, 7 November 2012, at 9:24 a.m.

In Response To: Re: IDS 10.00.FC11 on Sun 5.10 - Informix audit is (KARL OLIVER)

Karl,

I am not able to copy what exists on the customer server, but the issue is
with the RDRW audit event. There is a _default audit mask that includes
RDRW, however in the audit mask created for the user is is excluded as in
the following:

onaudit -a -u userX -r _default -e ACTB,BGTX,CLDB,CMTX,DLRW,INRW,RDRW,UPRW

This seems to work (based on my grep of this user id from the audit log)
for most sessions coming from the remote server for this id.
However, I keep seeing (no the application group has not gotten back to me
yet) 3 sessions with the same PID (in all cases I have checked
this is the PID for a cpu vp on the remote server) all act differently and
all have "console" as the tty for the session. I have verified that the
other sessions for this user id do in fact have select statements, but they
are not being audited, as per the mask. I have to assume that
this means that for some reason the _default mask is being used and thus
RDRW is being audited. I would like to understand why (what
circumstances this can happen under) this happens so that I can go back to
the customer with an explanation. This may have been occurring
for some time but was not noticed since the audit log files normally are
moved to another server for storage every 15 minutes and that
process broke last week and the local file system filled up.

Yes, one solution would be to remove RDRW from the _default mask, but
before I suggest that I would need buy in from the customer.

Thank you.

On Mon, Nov 5, 2012 at 2:33 PM, KARL OLIVER <karl.oliver@maf.govt.nz> wrote:

> are you able to list the audit mask settings realting to the problem ?
>
>
>
> *******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>

--e89a8f502e0c42960804cde87a5b

Messages In This Thread

• IDS 10.00.FC11 on Sun 5.10 - Informix audit issue
  Roger Kee -- Friday, 2 November 2012, at 8:46 a.m.
  • Re: IDS 10.00.FC11 on Sun 5.10 - Informix audit is
    KARL OLIVER -- Monday, 5 November 2012, at 2:33 p.m.
    • Re: IDS 10.00.FC11 on Sun 5.10 - Informix audi....
      Roger Kee -- Wednesday, 7 November 2012, at 9:24 a.m.
  • Re: IDS 10.00.FC11 on Sun 5.10 - Informix audit is
    KARL OLIVER -- Wednesday, 7 November 2012, at 1:57 p.m.
    • Re: IDS 10.00.FC11 on Sun 5.10 - Informix audi....
      Roger Kee -- Thursday, 8 November 2012, at 8:47 a.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.