IDS Forum

Re: How to determine auditing on/off

Posted By: Fernando Nunes
Date: Monday, 7 May 2012, at 11:04 a.m.

In Response To: Re: How to determine auditing on/off (MICHAL KIEK)

It can't be done as you'd like. A few clarifications:

1- Informix does not have "one" audit log. It has "n" audit logs (1 at each
moment). When the file "informixserver.n" reaches a certain size it closes
that oen and creates another called "informixserver.n+1"
2- The audit log should be kept in a directory where the permissions don't
allow it to be changed by someone not allowed
3- The audit configuration can only be changed by the audit analysis
officers (start, stop, audit file size and path, and behavior when audit
cannot be done) or the database system security officers (audit masks)
4- The audit log(s) should only be accessible to the audit analysis
officers, the only ones who can start/stop, change the level, path and
size. So in order to look into the audit logs you must belong to this
group. Since only people in this group can change those audit options,
you'd be checking things only you can change.... You'd be the police
officer and the "burglar"...
5- If you're looking into auditing seriously you must consider role
separation (more info on the manuals and some internet blogs and
discussions)
6- Some audit levels automatically include the actions of the DBSSOs
(changes in the audit masks). So this appear naturally in the audit log

So:

- auditing enabled/disabled:
Does not show up on the audit log

- audit log cleared
This would a normal file system operation. File system permissions must be
set so that it's not possible to change it unless you have the right
previleges

- audit log modified
It's constantly being changed when the auditing is turned on, until it
readhes the defined size. Than a new one is created

- auditing configuration changed
The mask changes can be automatically logged assuming a audit level that
includes the operations of the DBSSOs
The level itself, the file path and size and the behavior in case of audit
errors can only be changed by AAOs and are not reflected in the audit logs

Regards.

On Mon, May 7, 2012 at 3:14 PM, MICHAL KIEK <michal.kiek@gmail.com> wrote:

> So, it's for security monitoring purposes. Actually I need to check:
> - auditing enabled/disabled
> - audit log cleared
> - audit log modified
> - auditing configuration changed
>
> The monitoring software is checking log file, if specific event come it
> produce an alert.
> So I need to specify which mnemonic represents each of above events that I
> want to monitor.
>
> Of course I don't have audit log after disabling an auditing, but the event
> ("auditing disabled") should be storred in audit file and then alert should
> ben generated.
>
> Hope it's enough for you guys
>
> Does IDS generate event in audit log if you enable/disable auditing and
> how it
> looks like?
>
> thanks! ;)
>
>
>
> *******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
>

--
Fernando Nunes
Portugal

http://informix-technology.blogspot.com
My email works... but I don't check it frequently...

--20cf302ef74cd5300b04bf739203

Messages In This Thread

• How to determine auditing on/off
  MICHAL KIEK -- Sunday, 6 May 2012, at 5:32 a.m.
  • Re: How to determine auditing on/off
    Art Kagel -- Sunday, 6 May 2012, at 11:19 a.m.
    • Re: How to determine auditing on/off
      MICHAL KIEK -- Sunday, 6 May 2012, at 12:02 p.m.
      • Re: How to determine auditing on/off
        Fernando Nunes -- Monday, 7 May 2012, at 5:47 a.m.
        • Re: How to determine auditing on/off
          MICHAL KIEK -- Monday, 7 May 2012, at 10:14 a.m.
          • Re: How to determine auditing on/off
            Fernando Nunes -- Monday, 7 May 2012, at 11:04 a.m.
            • Re: How to determine auditing on/off
              MICHAL KIEK -- Monday, 7 May 2012, at 11:45 a.m.
              • Re: How to determine auditing on/off
                Fernando Nunes -- Monday, 7 May 2012, at 12:02 p.m.
              • Re: How to determine auditing on/off
                Richard Snoke -- Monday, 7 May 2012, at 1:21 p.m.
          • Re: How to determine auditing on/off
            Jonathan Leffler -- Monday, 7 May 2012, at 11:26 a.m.

IDS Forum is maintained by Administrator with WebBBS 5.12.