Skip to Main Content

Infrastructure Software

Announcement

For appeals, questions and feedback about Oracle Forums, please email oracle-forums-moderators_us@oracle.com. Technical questions should be asked in the appropriate category. Thank you!

Using Audit Service on Solaris 11.4 to audit/monitor for file and folder modification + deletion and logged it to syslog.

Bob ShizMay 28 2024 — edited May 28 2024

I am absolutely new to Solaris, running it on Virtualbox. I am trying to do what the title says. Tried to follow the documentations by following here for auditing of files/folder. .

Steps I did to start auditing files/folders:

# audit -s

# rolemod -K audit_flags=+fw:no root

# auditreduce -o file=… -O filechg

# praudit *filechg

Steps I did to configure it to syslog is exactly as shown in here.

However, after doing these, I am still unable to pipe any changes that was done to syslog. The only thing promising is that when praudit *filechg is entered, it shows the results below

But these results are not in syslog. And what I want is that the filename, time and also actions done be logged to syslog. Is this possible? Do let me know where did I go wrong and what did I missed out on as I know I surely did, unable to fully understand the documentation. Appreciate any help.

Comments
Post Details
Added on May 28 2024
1 comment
476 views