Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Auditing on the
Sidewinder G2
Chapter 19: Auditing and Reporting
Auditing on the Sidewinder G2
Auditing is one of the most important features on the Sidewinder G2. The
Sidewinder G2 generates audit each time the Sidewinder G2 or any
Sidewinder G2 service is stopped or started. Audit is also generated when any
of the Sidewinder G2’s audit facilities are modified. Other relevant audit
information that is captured includes identification and authentication attempts
(successful and failed), network communication (including the presumed
addresses of the source and destination subject), administrative connections
(using srole), and modifications to your security policy or system configuration
(including all administrator activity, such as changing the system time).
Audit can be viewed and monitored using tools such as Sidewinder G2’s
dashboard, audit viewing and reporting windows, and the off-box Sidewinder
G2 Security Reporter. Sidewinder G2 can also be configured to send alerts for
particular types of audit using IPS Attack Responses and System Event
Responses.
The Sidewinder G2’s audit facilities monitor the state of log files to minimize the
risk of lost data. Log files are compressed, labeled, and stored on a daily basis,
and a new “current” log file is created. Using this mechanism, no audit data is
lost during the storage transition.
The amount of available audit storage space is monitored very closely on the
Sidewinder G2 via the rollaudit and logcheck utilities to monitor the log file size
and rotate log files as needed. (For information on using rollaudit, see
“Rollaudit cron jobs” on page 599. For information on using the logcheck utility,
refer to the logcheck man page.)
There are three main components to the Sidewinder G2 audit process:
• auditd — This is the audit logging daemon. This daemon listens to the
Sidewinder G2 audit device and writes the information to log files. The log
files provide a complete record of audit events that can be viewed by an
administrator. auditd sends all audit data to a binary file called
/var/log/audit.raw.
• auditbotd — The Sidewinder G2 uses a daemon called auditbotd to
listen to the audit device and gather the security-relevant information it
finds. The auditbot daemon tracks these events and uses its configuration
to determine when the data might be indicating a problem and require a
response, such as an attempted break-in. If it does detect an audit event
that has a configured response, Sidewinder G2 responds accordingly. For
more information on configuring IPS attack and system event responses,
refer to Chapter 20.
• auditdbd — This daemon maintains the audit database. auditdbd monitors
the audit stream and sends reporting information to the MySQL database
called auditdb. The auditdbd server is disabled by default.
Important: Reporting services are not available until the auditdbd server is
enabled. For information on enabling the auditdbd server, see “Enabling and
disabling servers” on page 65.
533