I am trying to setup auditing for NISPOM requirements using the built-in linux audit kernel which uses auditd and audit.rules for setup. I have been able to meet all other requirements, but I cannot find a way to audit user logout actions. My audit.rules file is listed below
Code:
#This file contains the a sample audit configuration intended to
# meet the NISPOM Chapter 8 rules.
[code]....
I'm trying to add the -audit option to X Server. I run ps -ef | grep -v grep | grep "bin/X" and get: root 2511 2506 0 10:35 tty7 00:00:09 /usr/bin/X:0 -br -verbose -auth /var/run/dgm/auth-for-gdm-sScn1P/database -nolisten tcp vt7 So I'm thinking that I need to add -audit to the /usr/bin/X file, but I believe that it's binary and created by something else, but I can't find that "something else". How on earth can I add this option? I have opened up 1,000,000,000,000,000,000,000 files (slight exaggeration) and I've come up empty.
View 1 Replies View Relatedhow to audit and delete unwanted rpm packages. how to back up repository list from YaST2.
View 5 Replies View RelatedNeed to track which users are making changes to production files. I have a small number of administrators with access to su, but need to be able to identify which administrator is making changes to which files after they have su.I have read several post and articles regarding auditd tool, but it is not clear to me whether this tool can generate a log that shows the original user and file being altered.
View 3 Replies View Relatedis there any way to trigger a command or script whenever a certain event happens in a application like firefox.or at least trigger a script on the launching of an application.
View 2 Replies View RelatedAs a normal user I have activated the functions of the Quit applet, i.e. Logout, Shutdown and Restart are active buttons. I am able to restart or shutdown, no problems. But when I use the Logout button I don't get logged out, just returned to the login shell & I am still logged in as my user. I don't have a display manager installed and I do NOT want to use a display manager such as XDM or GDM. How do I get the Logout button to actually logout the user? It appears I am only getting logged out of the x-session, but I want complete logout.
View 6 Replies View RelatedOpenSUSE 11.1 - KDE 4.2
Can login to KDE 4.2, use it fine but when I attempt to logoff, it won't. Screen remains the same as before trying to logoff. Tried from root, same result. Only way out is shutdown -r now.
Gnome works w/no logoff problems.
I've been using OpenSUSE (11.2) and ssh to access my Ubuntu Server (8.04). The problem is that when I give the shutdown command to turn off the server (sudo shutdown -P now), OpenSUSE hangs and I can't close bash and the computer locks up. I then need to turn my OpenSUSE box off by pushing the power button. Any idea what might be causig this?I'm not sure if this is the right place to ask this question because I don't think this is a bash problem but I wasn't really sure where to ask this question.
View 6 Replies View RelatedI need to logout from a KDE 4.5 session remotely (via SSH) for a number of reasons. How can I do that from a bash shell?
View 4 Replies View RelatedWhenever vlc is running and I try to log out, a KDE window opens and tells me "logout cancelled by vlc". I have to repeat the process. How do I disable this unwanted "feature"? What if Thunderbird, Firefox, LibreOffice, Gwenview etc. all decided I shouldn't log out? Would I have to log out six or seven times? Doesn't sound logical to me.
View 8 Replies View RelatedWhenever I log out and re-login, my alsa is gone, and is replaced by oss. It won't even work after I do
Code:
rcalsasound restart
my alsa info:
[URL]
before logout my mixer (normal until i logoff):
after login:
It works good even if i hibernate or sleep but, breaks down while I logout and relogin... created a new user for testing: same problem persists.
I just upgraded to openSuSE 11.4 from 11.1. In 11.1 the contents of the virtual consoles are kept after a logout, so if I login again, I get the same environment as before. In 11.4 the contents are lost. How can I switch on this feature again?
View 9 Replies View RelatedSince upgrading to KDE 4.6.3 (from 4.6.2), I found the desktop names hadreverted to "Desktop 1", "Desktop 2", etc. I renamed them in "PagerSettings" but when I next logged on, I found they had reverted. I'verepeated it with a new .kde4 folder but that made no difference.raham Davis, Bracknell, Berks. E-mail: change 'boy' to 'man'openSUSE 11.4; KDE 4.6.3; AMD Phenom II X2 550 Processor;Video: nVidia GeForce 210; Sound: ATI SBx00 Azalia (Intel HDA);Wireless: BCM4306
View 4 Replies View RelatedI know how to launch a script whenever I turn off my computer; I just have to add it in the file /etc/halt.local. Such a script is launched just before the computer stops. Now I'd like to launch a script whenever I log out from my account. I'd like that, each time I log out from my account for instance to let someone else work with my computer on his own account, a script is automatically launched. I know how to launch a script when logging IN but not when logging out.
View 6 Replies View RelatedWhenever I log out and re-login, my alsa is gone, and is replaced by oss. It won't even work after I do
Code:
rcalsasound restart
my alsa info:
[URL]
before logout my mixer (normal until i logoff):
after login:
It works good even if i hibernate or sleep but, breaks down while I logout and relogin.
I have a primary language, Italian, and I want also use a secondary language, English. I want to switch language in order to have all the writings and messages in English not to write special characters by keyboard. I switched language in both kde system settings>Regional & language and in yast system>language leaving the keyboard layout Italian, but in the kde menu (the lizard on the left of panel) the groups of applications (multimedia, giochi, sistema) are in Italian and yast too (impostazioni amministratore), instead others are in English.
1)is this a bug or I forgot something?
2)which is the differences switching languages by yast and by kde system settings?
3)Is it possible to switch language and don't restart or logout the system?
Just ran into this issue with Suse 11.2. Everytime I try to change the desktop wallpaper, plasma crashes and returns me to the log in screen. This is the first time this has happened and it happens no matter what wallpaper I choose. Desktop effects are OFF. Strange that adding widgets to the desktop does NOT cause this crash, just changing the desktop wallpaper. The computer is using 855GM Intel Chipset.
View 2 Replies View Relatedwhat these information mean?What should I do to fix this?
(npviewer.bin:6947): Gdk-WARNING **: XID collision, trouble ahead
Shutting down nautilus-open-terminal extension
--- Hash table keys for warning below:
[code]....
I remember this was discussed some time ago but I cannot find the thread any more. I was just wondering if others are still seeing the same problem . I've had this all through 4.4.3 and now with 4.4.4. For some reason if only the logout or lock button is selected and placed on the far right of the panel then part of the button is chopped off. This only happens with the panel locked. If both buttons are selected then they display correctly. I also notice that when only one button is selected that it's size is slightly smaller than when both are selected. Also it only seems to be the logout/lock widget that has this problem.
View 1 Replies View RelatedAfter login is always volume level set on 100%. Alsactl store and restore works properly. Manually run: sudo /etc/init.d/alsasound reload reset volume level into proper level, but after login to Gnome is always volume level 100%,Here are some logs:
rpm -qa '*alsa*'
alsa-utils-1.0.21-3.1.x86_64
alsa-firmware-1.0.20-3.2.noarch
[code]....
how to record/save logout/shutdown messages for OpenSuse 11.2.
View 9 Replies View Relatedsomething odd I've noticed with 11.3 on my laptop--if I adjust my resolution through the Monitor applet in the Control Center or if I make changes to my Touchpad settings through the Control Center, the changes are lost when I log into my laptop. Do you think I botched an installation?
I've tried to determine what actual files are affected via the two applets with the thought that maybe I don't have the necessary permissions on them or that I can throw a bandaid on it with a start-up task to overwrite them. Alas, I've got nuthin'
When trying to "Leave" the system (either via the small button on the lower right of the taskbar or by right clicking on the Desktop and selecting "Leave") the logout / shutdown / restart screen comes up. I have the "Logout" desktop effect activated, which is supposed to desaturated the background when the Leave screen appears. However, instead of simply greying out the background, the image on the desktop and the rest of the screen also gets slightly distorted, with seemingly random distortion effects cropping up all over the place (e.g. horizontal lines or large blurs).
These distortions are different every time the Leave screen comes up. The Leave screen itself is displayed fine, and apart from the dodgy background I have no other issues with the whole process (the system shuts down or restarts properly according to my choice). I am using the Radeon drivers, and all other desktop effects I have on (Magic lamb, cover switch, present windows, etc) work fine and without a hitch. It's only the Logout effect that seems to glitch. Are the distortions intentionally created by the effect in order to emphasize the focus on the Leave screen?
I'd like to know how do I rotate the audit logs under "/var/log/audit/audit.log" every 6 month. Currently I have set the parameter inside /etc/audit/auditd.conf to "KEEP_LOGS" (Previously "ROTATE" )and logs files are generated up to the size 5M and never deleted. Do I need to change inside "/etc/audit/audit.rules" file?
[root@RHEL5 ~]# more /etc/audit/auditd.conf
#
# This file controls the configuration of the audit daemon
#
log_file = /var/log/audit/audit.log
[Code].....
I would like to log all the commands executed (in full) by all the users or alteast myself.
package lastcomm, doesn't store full command.
When the audit daemon starts and stops, I see DAEMON_START DAEMON_STOP in the audit log. I don't see a rule in audit.rules about logging this event. So, I'm guessing that it's a rule that's built into the audit daemon. Can you confirm this?Also, I've been looking for a explanation of the event types that the audit daemon logs, such as: USER_AUTH, USER_ACCT, CRED_ACQ. If you know of any docs that explain this,
View 2 Replies View RelatedOne of our customers is looking at enterprise audit of their data center (primarily consists of Linux servers) We suggested them towards a SNMP based tool that has some limitations. Any other recommendation is welcome...
View 1 Replies View RelatedStrange :during the configure. I have checked :checking for struct audit_tty_status... no#uname -aLinux lfslc5 2.6.18.8-xenU-64b #1 SMP Tue May 6 18:09:10 CEST 2008 x86_64 x86_64 x86_64 GNU/Linux
View 2 Replies View Relatedselinux and psacct is disabled in this system (RHEL5.6 2.6.18-194.11.3.el5 SMP x86_64). After performing a yum update, the syslog is flooded with kernel audit messages (related to PAM), even though audit service is turned off. Is there a way to disable this verbosity?
[Code]....
I am running RHEL 5.4 Server (32-bit) and have my audit.rules file set up per a template that I am required to use. There is one particular rule that audit is auditing the unlink of files. With this set, my log files are filling up very fast, as there is a particular app that constantly touches/ deletes a couple of files, which the unlink is catching. Here is the audit rule:-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295 -k deleteI commented out the "-S unlink" and my logging returns to normal (as expected). For right now, I was wondering if there was a way to set this rule up to exclude these couple of files from what auditd is capturing?
View 1 Replies View Related