InTrust 11.3.2 - Preparing for Auditing and Monitoring IBM AIX

Syslog Configuration Monitoring

Suppose you use a finely-tuned Syslog audit policy in your environment. Your audit configuration has proven efficient and reliable, and you do not want anyone but a few trusted administrators to be able to change it. Even so, you want to know immediately if the audit policy is modified in any way.

Use InTrust real-time monitoring capabilities to enable immediate notification. Syslog audit configuration is defined in the syslog.conf file, so the solution in this case is to monitor this file with InTrust and send an alert whenever the file is modified.

Enable the “Syslog.conf file modified” rule and supply the appropriate file paths as the rule's parameter.

Tracking Security Incidents

You want to receive daily information about possible security issues in your environment, such as brute force attack attempts.

You can achieve this by scheduling gathering and reporting jobs with InTrust.

Take the following steps:

1. Make sure that syslogd is running.
2. Create an InTrust task that gathers Syslog events from the appropriate site (gathering job) and builds reports based on the gathered data (reporting job).The resulting reports are stored in the local folder that is specified during InTrust installation (for details, see the Specifying reporting settings section in the Installing the First Server in InTrust Organization topic in the Deployment Guide).
3. A good report for this scenario is “AIX Multiple failed login attempts”.
4. It is up to you whether you want to store the gathered data in an InTrust repository. You can also include a notification job to get notified of task completion.
5. Schedule the task to run every morning at a convenient time.

Audit Log Event Format

This section describes the format to which the InTrust agent converts the Audit log trails it receives. A typical Audit log trail is like this:

Wed Jun 20 15:37:16 2007 FS_Mkdir jsmith OK smbd root 450648 245934 819443 00C8967E4C000000

mode: 755 dir: tmp/data

From these trails, the agent produces event records for the audit database. Each event record has a fixed number of fields, which are described in the following table. These fields are always present, even if their values are empty.