Follow Techotopia on Twitter

On-line Guides
All Guides
eBook Store
iOS / Android
Linux for Beginners
Office Productivity
Linux Installation
Linux Security
Linux Utilities
Linux Virtualization
Linux Kernel
System/Network Admin
Scripting Languages
Development Tools
Web Development
GUI Toolkits/Desktop
Mail Systems
Eclipse Documentation

How To Guides
General System Admin
Linux Security
Linux Filesystems
Web Servers
Graphics & Desktop
PC Hardware
Problem Solutions
Privacy Policy




System Administration Guide: Security Services
Previous Next

Auditing Efficiently

The following techniques can help you achieve your organization's security goals while auditing more efficiently.

  • Randomly audit only a certain percentage of users at any one time.

  • Reduce the disk-storage requirements for audit files by combining, reducing, and compressing the files. Develop procedures for archiving the files, for transferring the files to removable media, and for storing the files offline.

  • Monitor the audit data in real time for unusual behaviors. You can extend management and analysis tools that you have already developed to handle audit records in syslog files.

    You can also set up procedures to monitor the audit trail for certain activities. You can write a script to trigger an automatic increase in the auditing of certain users or certain systems in response to detection of unusual events.

    For example, you could write a script that does the following:

    1. Monitors the creation of audit files on all the audit file servers.

    2. Processes the audit files with the tail command.

      The piping of the output from the tail -0f command through the praudit command can yield a stream of audit records as the records are generated. For more information, see the tail(1) man page.

    3. Analyzes this stream for unusual message types or other indicators, and delivers the analysis to the auditor.

      Or, the script can be used to trigger automatic responses.

    4. Constantly monitors the audit directories for the appearance of new not_terminated audit files.

    5. Terminates outstanding tail processes when their files are no longer being written to.

Previous Next

  Published under the terms fo the Public Documentation License Version 1.01. Design by Interspire