The audit tag has no wiki summary.
2
votes
1answer
71 views
Server locking up, /var/log/messages reports “backlog limit exceeded”
We have a CentOS OS that became unresponsive this morning to external network traffic. It is a virtual machine. I was able to reboot the VM. After logging back in, I found the following in the ...
2
votes
2answers
37 views
Auditing changes to the audit log
I have configured auditd for PCI compliance reasons
PCI states that existing logs cannot be changed without generating an alert
This article ...
0
votes
0answers
63 views
Solaris Auditing (BSM) - How to log argv to syslog
By default, it seems that the argv from execs is not passed to the audit_syslog.so plugin. The binary audit log has the arguments included, but the plugin won't write them into the syslog. Everything ...
1
vote
6answers
130 views
Network Administration and Auditing Tools
We're a small company (~50) who outsource the bulk of our IT to an... average quality provider. I am taking on the role of day-to-day IT (think of things that can be fixed in 15 mins or less only). ...
1
vote
1answer
123 views
CentOS - Percona MySQL - Not Reading /etc/my.cnf
I've compiled Percona 5.5 on my CentOS 6.1 server and it starts fine, however it doesn't appear to be reading my /etc/my.cnf file.
# In /etc/my.cnf
character_set_server = utf8
collation_server = ...
0
votes
0answers
20 views
Configuring and managing CentOS auditing
I run a small stack of servers and recently the stack has become fairly unstable with random system hangs/reboots occurring about once a week. I think I've traced the source of the fault by examining ...
5
votes
1answer
84 views
Exchange security monitoring tools
I am trying to identify tools that can perform security monitoring of Exchange. Ideally, the tools should be able to pick up things like:
permission changes for high risk mailboxes
multiple ...
0
votes
1answer
41 views
database scanning tools recommendation? [closed]
Lately my boss is asking me to looking into database scanners. I know very little about db scanning technology. Just wondering if it is worth to purchase tools like Sentrigo ( ...
1
vote
4answers
51 views
sendmail sending mail to recipients I don’t know of; possible spam host
Recently I did an audit of my machine with logwatch and found out that my machine sends around 582 mails everyday.
STATISTICS
----------
Messages To Recipients: 582
Addressed Recipients: ...
4
votes
1answer
78 views
Survive a Software Audit
I received a letter from Autodesk asking for a "License Assessment". I understand it as a software audit. They plan to do it remotely.
The thing is, I'm a freelancer, I don't use any Software Asset ...
0
votes
1answer
52 views
Audit folder permissions on a windows server
I have a number of servers in the corporate domain that seem to randomly lose ACL permissions to the TEMP folders (c:\temp, c:\windows\temp and any temp folder defined in the environment variables).
...
0
votes
2answers
48 views
Logging user activities
I add the following line to my bash_profile file to log all my activities.
script ~/mylog_$(date '+%Y%m%d%H%M').log
If I have 100 users, I can not modify all the user accounts with the change ...
3
votes
1answer
82 views
Possible to forward logs for microsoft products
This may be a duplicate, as i'm fishing for information, as I'm not that au fait with logging on windows. I know on Unix you can ship syslogs via the relay and RFC 5424. I also know you forward ...
3
votes
1answer
38 views
Possible to audit newly added Exchange 2007 ActiveSync devices?
We have a client who would like to be notified when a new ActiveSync device is added. My thoughts are that this is not possible but I would like to confirm.
1
vote
0answers
44 views
Want to find cause of recurring failed SQL Server 2005 login attempts
I've been noticing recurring failed logon attempts onto our SQL server. It happens every minute with the same login. An example from the log file viewer
10/18/2011 13:54:50,Logon,Unknown,Login ...
0
votes
0answers
19 views
Exchange 2007 - Attachment Monitoring
Through logging on Exchange 2007 is it possible to log / monitor the filenames of attachments received and sent through an exchange server?
3
votes
2answers
89 views
Software for monitoring a Windows network environment (Change Control)
I need to implement change control and auditing in a Microsoft Windows network environment. My question is in methods to audit or better yet changes made to the networking environment. This starts ...
3
votes
0answers
44 views
Log creation mailbox
We are trying to acquire a new certificate/label. In order to get this certificate/label we need to monitor the creation of mailboxes in Microsoft Exchange.
Is there a way to log the creation of a ...
0
votes
0answers
25 views
How to audit when a particular program / exe is run
I want to audit our users computers for when a particular program is run, kind of like getting a more detailed report on the lines of the "Used Rarely / Occasionally" type you see in Add/Remove ...
1
vote
1answer
65 views
Is there a way to pam_tty_audit on Linux OpenVZ containers?
Looks like pam_tty_audit in Linux (http://www.slashzero.com/2009/11/shell-session-logging/) could have been a great way to help figure out "what happened!" when one gets rooted.
I say "could have ...
3
votes
2answers
59 views
How do you check that servers/pcs are not infected
Simple question. Developers PCs have to have free access to network, including servers etc., and they have to have administrative access to perform work effectively.
However developers also use a lot ...
1
vote
2answers
160 views
DML Auditing (“Who did inserts?”)
Does an out-of-the-box newly created database (in SQL Server 2008) keep any DML audit records, such as:
User 'George' did an insert on table
'Alpha' on 6/20/2011
User 'Fred' did a delete on table ...
0
votes
1answer
70 views
What does “Invalid AVC allowed in current policy” mean?
I was looking into my selinux alert logfile and running over multiple entries labeled
**** Invalid AVC allowed in current policy ***
I understand that this signals a problem (on read or getattr ...
2
votes
2answers
80 views
Determine when a Domain Controller was promoted
On Windows Server 2003 standard is there a way to determine when a domain controller was promoted?
This is for an Active Directory 2000 functional domain.
The event logs don't go back far enough.
0
votes
2answers
59 views
check inventory of IBM software on *nix machines
We have a bunch of *nix machines some of which probably have IBM software installed on them.
Is there a way to identify the machines and the type of IBM software that is installed?
1
vote
0answers
37 views
Windows 2008 Audit - Acess Request Information
I'm auditing some folders in a Windows 2008 R2 server and I have a "Success Audit" entry in the Security Event Log with the following "Access Request Information":
Access Request Information:
...
0
votes
0answers
43 views
Failure Audit on SQL Server
It may be a classic but yes I am newbie and I need your help with stg.
Server 2003 and SQL Server 2005 runs on the same server. A process (.exe) has to be running all the time. However, sometimes I ...
1
vote
1answer
64 views
Auditing user behavior in a small organization to prepare IT restructuring
My company will be working on restructuring/rethinking the whole IT infrastructure for a small company (about 25 employees). A part of this is a migration to Google Apps for email, calendar, etc. That ...
3
votes
2answers
63 views
Is there any viable alternative to using Oracle Auditing
I am currently tasked with developing a action plan for monitoring DB activity, encompassing general actions (failed logons etc) with some finer grained monitoring(e.g. who selected from table x, what ...
1
vote
1answer
144 views
Recommend tools for auditing/testing MIT Kerberos Passwords
Debian 6
MIT Kerberos i.e. krb5
I want to be able to audit/test the passwords in our Kerberos server periodically for quality. If the passwords can be cracked quickly I want to notify the users to ...
0
votes
1answer
689 views
Windows Filtering Platform not turning off until admin logon. Win2008R2sp1
Just installed Windows Server 2008R2 SP1 to see if it would fix this problem, but it didn't.
Until an administrator logs onto the domain controller, there are many events that WFP blocked a connection ...
0
votes
3answers
422 views
Export a list of installed features on a Windows 2008 server
I have been asked to specify the features which are installed on a production web server so a replica test environment can be created.
I could point and click my way to the solution but I am curious ...
1
vote
1answer
58 views
SQL Server 2008 Audit Service
I'm designing an application that will run on SQL Server 2008 R2. There's a requirement to audit any updates to a customer table. The new Audit service that was release as part of SQL Server 2008 ...
2
votes
2answers
497 views
Best practice ACLs to prepare for auditors?
An auditor will be visiting our office soon, and they will require read-only access to our data. I have already created a domain user account and placed them into a group called "Auditors".
We have a ...
0
votes
2answers
169 views
Auditing bandwidth of remote sites
I would like to do an automatic audit of bandwidth of my remote offices. I understand that there are many websites where I could ask each user to go to a webpage and run the test. I was hoping there ...
1
vote
3answers
267 views
Tools to monitor users activity on Linux/Unix servers
Is there any specific open source tool which can be used to monitor what users are doing on linux system. I have multiple servers and with access to some users on them. I want to monitor which user ...
0
votes
1answer
92 views
How well does Cocoa allow auditing of I/O to USB, FireWire and optical media on a Mac?
I have a client who wants us to lock down the Mac laptops we're using to access his data. He wants an audit of all files read and written from removable media (USB, FireWire, optical). I have a ...
3
votes
1answer
106 views
Is Exchange protected from/allow back dated emails?
Does Exchange Server adequately protect against backdating items in a mailbox folder? I want to determine from an auditing perspective what level of risk exists/what trust can be put into Exchange ...
2
votes
3answers
287 views
Is it worth running nessus as well as OpenVAS?
Apparently OpenVAS originated as a fork of Nessus. It is very easy to install and use OpenVAS because it's, well, open. However, am I kidding myself if I just use that instead of Nessus? Should I ...
6
votes
3answers
2k views
Sending audit logs to SYSLOG server
I'm running several RHEL based systems which utilize the audit functionality within the 2.6 kernel to track user activity and I need to have these logs sent to centralized SYSLOG servers for ...
0
votes
2answers
71 views
sql server 2008: how do you set up a trace on a specific database?
i am trying to use sql server profiler to trace all the sql statements on a specific database, is this possible to do?
0
votes
2answers
848 views
Disable audit of Logon Logoff
I have a SBS 08 with 50 users on my domain. In Event Viewer : Windows Logs > Security, I've got nearly 300,000 events about EventID 4624 Logon, 4634 Logoff, 4776 Credential Validation, 4769 Kerberos ...
1
vote
2answers
149 views
Are there free secure ways to audit a LAMP's security configs?
Problem is new to LAMP, and want to test the system config in any automated checklist way.
Any suggestions?
1
vote
2answers
5k views
How to detect Windows Server 2003/2008 Release (R1 or R2) programatically?
I can easily pickup whether a server is Win2k3, 2k8, standard edition, enterprise edition, x86, x64, but I cannot find a way of determining if it's Release 1 or 2. HP Systems Insight Manager somehow ...
1
vote
1answer
67 views
Exchange End User Usage Statistics Tools
Anyone know of software/tools used to measure and draw reports based off of end user Exchange usage? Items for a particular user would include:
How many messages a day
List of top receipts from that ...
1
vote
2answers
394 views
problem of setting audit rules: Syscall name unknown: stime
I am setting audit rules in /etc/audit/audit.rules.
As the requirement : The audit system should be configured to audit all administrative, privileged, and security actions.
So I add one line into ...
12
votes
8answers
671 views
How do I inventory the type and speed of a remote computer?
I'm on a Windows 2003/2008 corporate network with 100 users. I've been tasked with increasing the RAM on all end-user workstations.
The problem is we have a mixture of different computers in our ...
1
vote
2answers
131 views
Could anyone give me some suggestion about configure secure audit system
I'm new about configure audit system. And I have some tasks such as
configure audit system to audit failed attempts to access files and programs.
configure audit system to audit files and programs ...
1
vote
3answers
476 views
Tracking who installed Software on server
Am I correct, that if a program is installed on a Server and shows up in the 'Add Remove/Program programs', then it must have been installed when a user has logged onto the server either at the ...
0
votes
3answers
102 views
How to obtain info on pornographic content of a web site without entering the website for auditing purposes?
Is there a method or service that gives me a detailed text report on the pornographic content or status of a particular web site? I need this to audit users account without having to get into a ...
