VERY basic question

[Margaret M Sanders]

Hi all. I 've been lurking around, listening for things I can use...but I'm not where you guys are at in terms of auditing.  I still have a requirement, however.

So, help me to understand a very basic functioning of Linux (I imagine its basic).

In a standalone system:

How in the world do I capture, create and save human readable reports and then clear audit logs.

Which BASIC /var/log should every accidental sysad (like myself) be capturing?

I know where to put the audit rules, but at this point, I'm just sort of following instructions for that without any real sense of understanding.  The farthest I've gotten is -w means watch.

If you guys would take a moment to ask such a rudimentary question, I might be able to move past go.

Thank you for your time.

Margaret M. Sanders
SwRI ISSO/ATA

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20140210/c045cea8/attachment.htm>