<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7652.24">
<TITLE>RHEL 5 audit events</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">RHEL 5</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Have two events having difficulty capturing or reviewing with the audit sub-system.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">1. su - "non_existent_account". Using the nispom.rules provided by audit 1.5.6-1. Using various ausearch parameters, am unable to find a corresponding failure when attempting to "su" to a non-existent account.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">2. Non-privileged user attempting to change the date/time on the server. Of course the user fails to be able to do so, but am unable to capture or review the event.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Not sure if these are audit rule configuration or search unknowns or audit sub-system limitations.</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Thank you</FONT>
<BR><FONT SIZE=2 FACE="Arial">Art Henning (CSL) </FONT>
<BR><FONT SIZE=2 FACE="Arial">Enterprise IT Solutions</FONT>
<BR><FONT SIZE=2 FACE="Arial">Northrop Grumman Corporation</FONT>
<BR><FONT SIZE=2 FACE="Arial">art.henning@ngc.com</FONT>
</P>
</BODY>
</HTML>