0
votes
1answer
321 views

Disable auditing of logon type 3 events

I have an older 2003 server that hosts an in house application running on IIS with windows authentication. Is there a ready way to disable auditing only for the logon type 3 (network logon)? This ...
-1
votes
1answer
64 views

Log all the activity of screen session to a file

Is that possible to start a screen session on login of any users in Linux system and log each and every activity done by him in a file for later review or email that after his logout.. Basically, I ...
9
votes
3answers
2k views

Logging a “persons” activity in Linux

So I've read many of the posts related to this and have just come up more confused than before. There are recommendations for various tools including ttyrec, snoopy, acct, rootsh, sudosh, ttyrpld, ...
10
votes
7answers
2k views

Hacking prevention, forensics, auditing and counter measures

Recently (but it is also a recurrent question) we saw 3 interesting threads about hacking and security: My server's been hacked EMERGENCY. Finding how a hacked server was hacked File ...
0
votes
1answer
2k views

What is the difference between an Audit Log and a regular Log (In the context of mod_security)?

I am using mod_security What is the difference between and audit log (audit trail) and a normal log? I read on wikipedia that an audit log is a log of user activity, if this is the case what would ...