Sidewinder G2 6.1.1 Administration Guide - Glossary of Technical ...

Auditing on the Sidewinder G2
18-20 Monitoring, Auditing, and Reporting
Line 1: This line lists the date and time, the facility that audited the
message (such as the Kernel, FTP or Telnet), the location, known
as the area), in the facility that audited the message (such as
general area or Sidewinder G2 library), the type of audit message
(such as Domain Definition Table Type Enforcement violation or
access control list) and the priority of the message (such as major
or minor).
Note: Network probe attempts do not contain lines two or three.
Line 2: This line lists the process ID, the real user ID, the effective
user ID, the process group ID, the process family ID (Sidewinder
G2-specific) and the command associated with the process ID.
Line 3: This line lists the real domain the process is running in and
the effective domain (the domain that the process for which
permission is given).
Lines 4 and 5: These lines provide eight pieces of data. The fourth
line, which always begins with “permwanted,” contains the integer
representation of the permissions requested by the process and
granted to the process, the domain of the requesting process, and
the type of file that the process is requesting access to. The fifth
line contains the filename and the permissions wanted and granted
for the file.
In general, the data in an audit message is a tag name followed by a
colon and the value of the tag. Table 18-3 contains examples and
descriptions of some of the tags used in audit messages that appear in
the audit results window.