0

I assigned a user the "User Security" profile so that they could reset user passwords and unlock accounts.

Does Solaris keep a record of whenever users execute pfexec?

I didn't see any records in /var/adm/messages. I didn't see anything in the audit logs using praudit <audit_log_file> | grep pfexec.

2

Found it logged under audit class as. Then using:

auditreduce -c as <audit_log_file> | praudit | grep "profile command"

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.