Sidewinder G2 6.1.2 Administration Guide - Glossary of Technical ...

Understanding audit messages
Chapter 19: Auditing and Reporting
Auditing on the Sidewinder G2
When viewing audit messages in the Admin Console, the form may vary
depending on the purpose and content of the message. The form of the first
two lines is the same for all audit messages, and provides general information
about the process generating or causing the audit. The third line will vary, but
usually includes Type Enforcement information and possibly some additional
information. The other lines of an audit message will vary depending on the
type of audit message.
Important: To view audit message files, see “Viewing audit information” on page
534.
Sample audit message
The message below is an example of a Type Enforcement audit message
(using the te_filter filter). The numbers have been added to link the example
line with the bullets below.
(1)Jan 17 08:16:20 2006 CST f_kernel a_tepm t_ddtviolation p_major
(2)pid: 19499 ruid: 100 euid: 100 pgid: 19499 fid: 0 logid: 100 cmd: 'grep'
(3)domain: User edomain: User hostname: myg2.example.com
(4)permwanted: 1 permgranted: 0 srcdmn: User filedom: Admn filetyp: file
(5)file: rc.local OP: 0x2000042 perm wanted: 0x1 perm granted: 0x0
• Line 1 — This line lists the date and time, the facility that audited the
message (such as the Kernel, FTP or Telnet), the location (known as the
area), in the facility that audited the message (such as general area or
Sidewinder G2 library), the type of audit message (such as Domain
Definition Table Type Enforcement violation or access control list) and the
priority of the message (such as major or minor).
Note: Network probe attempts do not contain lines two or three.
• Line 2 — This line lists the process ID, the real user ID, the effective user
ID, the process group ID, the process family ID (Sidewinder G2-specific)
and the command associated with the process ID.
• Line 3 — This line lists the real domain the process is running in and the
effective domain (the domain that the process for which permission is
given). This also lists the system’s host name.
• Lines 4 and 5 — These lines provide nine pieces of data. The fourth line
contains the integer representation of the permissions requested by the
process and granted to the process, the domain of the requesting process,
and the type of file that the process is requesting access to. The fifth line
contains the filen ame and the permissions wanted and granted for the file.
In general, the data in an audit message is a tag name followed by a colon and
the value of the tag. Table 35 contains examples and descriptions of some of
the tags used in audit messages that appear in the audit results window.
547