Auditing is the recording of security-relevant
activity as it occurs on the system and the subsequent analysis of
this audit log. With auditing, you can monitor users' activity
on the system and, if necessary, reconstruct events leading up to
attempts to compromise the security of your system. Thus, it is not
as much a method of protecting the system and its data as a method
of analyzing and recording system use.
Anything that has to do with a user's access
to the system or to a protected object within the system is considered
a security-relevant activity. Such activities are called events. Typical events include the following:
Logins, logouts, or login
failures
Changes to the authorization
database
Access to a protected
object, such as a file, device, or global section
Changes in privileges
or the security attributes of protected objects
The operating system can record both successful
and unsuccessful events. Sometimes the unsuccessful can be more revealing.
For example, it is less important to record that a programmer displayed
a file to which he had access than that the same programmer tried
to but was prevented from displaying a protected file.
The event message itself can be written to two
places: an audit log file or an operator terminal that is enabled
to receive security class messages. As “Sample Alarm Message” shows, a message contains the following
data:
Date and time of the message
Type of event
Date and time the event
occurred
The process identification
(PID) of the user who caused the event
Additional information in auditing messages is
specific to the type of event. See “Alarm Messages” for examples of different messages.
Example 10-1 Sample Alarm Message
%%%%%%%%%%% OPCOM 25-JUL-2008 16:07:09.20 %%%%%%%%%%%
Message from user AUDIT$SERVER on GILMORE
Security alarm (SECURITY) on GILMORE, system id: 20300
Auditable event: Process suspended ($SUSPND)
Event time: 25-JUL-2008 16:07:08.77
PID: 30C00119
Process name: Hobbit
Username: HUBERT
Process owner: [LEGAL,HUBERT]
Terminal name: RTA1:
Image name: $99$DUA0:[SYS0.SYSCOMMON.][SYSEXE]SET.EXE
Status: %SYSTEM-S-NORMAL, normal successful completion
Target PID: 30C00126
Target process name: SMISERVER
Target username: SYSTEM
Target process owner: [SYSTEM]
