Audit log for user defines

[Call, Tom H]

Hello,

 Here in the defense industry we are very pleased that the current
production version of the audit daemon 1.0.3-6 for Enterprise 4 U2 now
has the functionality to capture user defined audit events ( such as,
auditctl -w /etc/passwd -k passwd -p wa ).
 
 This audit capture ability is crucial to satisfy our auditing
requirements for the NISPOM Chapter 8, which we must do. Prior to this
we have had to rely on the third party product 'Snare' to capture audit
events on what the NISPOM calls 'Security Relevant Objects'. But as you
may know 'Snare' requires its own audit daemon, not a good thing for us
because it requires a modified kernel.

 But back to the native audit daemon 1.0.3-6, what we have found is that
both the user defined audit events, using auditctl, and the default
audit events, coded in the audit daemon?,  are both written to the same
log file /var/log/audit/audit.log by default. This combining of all
audit events into one log is not our preference because the audit events
required to satisfy NISPOM Chapter 8 are not the same requirements of
CAPP auditing. The CAPP default audit events are not at all needed for
NISPOM Chapter 8 and actually makes it harder to filter and manage the
audit.log.

 What we would like to see added to audit package is the ability to log
the default CAPP audit events and the user defined audit events to
separate log files. We would be pleased if you would consider making
this change.
 Thanks!

Tom Call
Lockheed Martin Missiles and Fire Control - Orlando, SCOC
desk(paged): (407)356-4959  pager: (407)981-8177


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20051028/7a9496fc/attachment.htm>