os/doc
3
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Small corrections to audit chapter.

Browse source 
Submitted by: Taras Korenko
Sponsored by:	iXsystems
This commit is contained in:
Dru Lavigne 2014-03-31 14:14:58 +00:00
parent e69f29a66d
commit 2dee9039e5
Notes: svn2git 2020-12-08 03:00:23 +00:00 
svn path=/head/; revision=44395
1 changed files with 12 additions and 13 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

25
en_US.ISO8859-1/books/handbook/audit/chapter.xml
View file

@ -196,8 +196,10 @@ requirements. -->
<title>Audit Configuration</title> <title>Audit Configuration</title>
<para>User space support for event auditing is installed as part <para>User space support for event auditing is installed as part
of the base &os; operating system. Kernel support can be of the base &os; operating system. Kernel support is available
enabled by adding the following line to in the <filename>GENERIC</filename> kernel by default,
and &man.auditd.8; can be enabled
by adding the following line to
<filename>/etc/rc.conf</filename>:</para> <filename>/etc/rc.conf</filename>:</para>
<programlisting>auditd_enable="YES"</programlisting> <programlisting>auditd_enable="YES"</programlisting>
@ -217,10 +219,7 @@ requirements. -->
<para>Selection expressions are used in a number of places in <para>Selection expressions are used in a number of places in
the audit configuration to determine which events should be the audit configuration to determine which events should be
audited. Expressions contain a list of event classes to audited. Expressions contain a list of event classes to
match, each with a prefix indicating whether matching records match. Selection expressions are evaluated from left to
should be accepted or ignored, and optionally to indicate if
the entry is intended to match successful or failed
operations. Selection expressions are evaluated from left to
right, and two expressions are combined by appending one onto right, and two expressions are combined by appending one onto
the other.</para> the other.</para>
@ -383,10 +382,10 @@ requirements. -->
</table> </table>
<para>These audit event classes may be customized by modifying <para>These audit event classes may be customized by modifying
the <filename>audit_class</filename> and <filename>audit_ the <filename>audit_class</filename> and
event</filename> configuration files.</para> <filename>audit_event</filename> configuration files.</para>
<para>Each audit event class is combined with a prefix <para>Each audit event class may be combined with a prefix
indicating whether successful/failed operations are matched, indicating whether successful/failed operations are matched,
and whether the entry is adding or removing matching for the and whether the entry is adding or removing matching for the
class and type. <xref linkend="event-prefixes"/> summarizes class and type. <xref linkend="event-prefixes"/> summarizes
@ -650,8 +649,8 @@ trailer,133</programlisting>
<para>Since audit logs may be very large, a subset of records can <para>Since audit logs may be very large, a subset of records can
be selected using <command>auditreduce</command>. This example be selected using <command>auditreduce</command>. This example
selects all audit records produced for the user selects all audit records produced for the user
<replaceable>trhodes</replaceable> stored in <systemitem class="username">trhodes</systemitem> stored in
<replaceable>AUDITFILE</replaceable>:</para> <filename>AUDITFILE</filename>:</para>
<screen>&prompt.root; <userinput>auditreduce -u <replaceable>trhodes</replaceable> /var/audit/<replaceable>AUDITFILE</replaceable> | praudit</userinput></screen> <screen>&prompt.root; <userinput>auditreduce -u <replaceable>trhodes</replaceable> /var/audit/<replaceable>AUDITFILE</replaceable> | praudit</userinput></screen>
@ -739,8 +738,8 @@ trailer,133</programlisting>
<para>Automatic rotation of the audit trail file based on file <para>Automatic rotation of the audit trail file based on file
size is possible using <option>filesz</option> in size is possible using <option>filesz</option> in
<filename>audit.control</filename> as described in <xref <filename>audit_control</filename> as described in <xref
linkend="audit-config"/>.</para> linkend="audit-auditcontrol"/>.</para>
<para>As audit trail files can become very large, it is often <para>As audit trail files can become very large, it is often
desirable to compress or otherwise archive trails once they desirable to compress or otherwise archive trails once they