Auditing....

From: James Anderson <anderson_at_ocaxp1.cc.oberlin.edu>
Date: Thu, 15 May 1997 13:49:20 -0400 (EDT)

Any advice on what events to audit and what not to audit? Out of the box,
everything is turned on. I hadn't gotten to the point of looking into the
subsystem, /var filled up and it shut my machine down. Figured out how to
handle that part, but I'd like some advice on what to audit on success and
failure. Comments?

Jim

----
_______________________________________________________________________________
James C. Anderson                      PHONE: (216) 775-6929
Computer Systems Manager                 FAX: (216) 775-8573
Houck Computing Center                 Email: anderson_at_ocaxp1.cc.oberlin.edu
Oberlin College                   Home Page: http://www.oberlin.edu/~anderson/
Oberlin, OH 44074
_______________________________________________________________________________

Received on Thu May 15 1997 - 20:07:58 NZST