1
vote
0answers
47 views

Ignoring auditing messages for particular PAM messages

I've got too many messages from PAM logging into audit.log, like this: type=USER_ACCT msg=audit(1378995943.792:867411): pid=4419 uid=0 auid=4294967295 ses=4294967295 ...
1
vote
1answer
84 views

How does fastCGI PHP alter a file and escape detection by auditd?

The other day I set up a little shell script on a Debian server to send me an email when files change; it looks like this: #!/bin/sh items=`find /var/www/vhosts -regex ".*/httpdocs/.*" -newer ...
5
votes
1answer
969 views

Suggestion for auditd set-up

I am trying to learn about securing a Linux box (I am using Ubuntu). Auditd is recommended for monitoring activities on the node. I have managed to install it, but I can't find much information about ...