![为 rmdir 和 syslog 收集配置 AIX 审核](https://linux22.com/image/216358/%E4%B8%BA%20rmdir%20%E5%92%8C%20syslog%20%E6%94%B6%E9%9B%86%E9%85%8D%E7%BD%AE%20AIX%20%E5%AE%A1%E6%A0%B8.png)
如何配置 AIX Unix 系统中的审核功能来收集有关删除目录的信息(尽管rmdir
)并将其发送到 syslog?
答案1
试试这个(#
意味着升级权限):
# smit syslog # install syslog
# chuser audit=true <user you wish> # enable auditing
# echo "rmdir:fac=AUE_RMDIR:lo=none:hi=none" >> /etc/security/audit/config
# startsrc -s auditd # start the daemon
$ rmdir some-dir
# grep AUE_RMDIR /var/log/syslog.log # check if info was collected