[tru64] Which audit events should be logged?

From: F. Winter <winter_at_PHYSnet.uni-hamburg.de>
Date: Mon, 15 May 2000 18:04:27 +0200 (MET DST)

Hi Admins,

I want to set up the audit subsystem on DUV4.0f. During this I have to
decide which events should be logged and which not. Logging which events
should be a good balance of log-amount and intrusion detection ability?
How do you handle this? Do you log the trusted_events only?

Thanks for any response.

--
 Frank Winter          Tel.: +(49)-40-42838-2404
 PHYSnet RZ            Email: winter_at_PHYSnet.uni-hamburg.de
 Univesitaet Hamburg
 Jungiusstr. 9
 D-20355 Hamburg

Received on Mon May 15 2000 - 16:05:11 NZST