Very Computer

Hi all,

- I enabled BSM by runing the script /etc/security/bsmconv
- The file /etc/system is updated. I reboot the server.
- The process auditd is started at boot.

Now, i have binary file in directory :
/var/audit/20050309114754.not_terminated.MyServer

Can you tell me how can i read this file ?
Where process auditd log data (/var/adm/messages... ?)

Does BSM consume lot of Memory/CPU ?

ThankYou very much for your help
NS

PRAUDIT can be used to convert audit data into several ascii format.

But does BSM use lot of Memory/CPU ?

Thank You very much

Best Regards
NS

Quote:> Hi all,

> - I enabled BSM by runing the script /etc/security/bsmconv
> - The file /etc/system is updated. I reboot the server.
> - The process auditd is started at boot.

> Now, i have binary file in directory :
> /var/audit/20050309114754.not_terminated.MyServer

> Can you tell me how can i read this file ?
> Where process auditd log data (/var/adm/messages... ?)

> Does BSM consume lot of Memory/CPU ?

> ThankYou very much for your help
> NS

depends.

i think it matters how much stuff you record in the audit.
if you gather a lot of stuff, it takes more.
probably more important is the age of the machine.  there's a
machine here with CPUs at 300MHz, i think that's right, and
it was painful enough to make them stop doing it.  the people
involved were fairly impatient, so it may have been around
10%.  which is a lot, but....

on my 880, i turned it off and nobody noticed anything.

j.

--

Head of Sun Support, Sr. Operating Systems Specialist
Applied Research Labs, Computer Science Div.                   S224
University of Texas at Austin

Quote:> on my 880, i turned it off and nobody noticed anything.

I run a limited bsm audit on everything from a ultra5 to an 880 with no
noticable overhead.  You do have to manage the log files in /var/audit.

--
Geoff Lane
Any comedy program described a "Zany" in the program guide will be rubbish.