Re: How to log - commands and file access

Hello,

Concerning BASH logging, I have found a bash "syslog version" :
        Nov 9 18:24:04 linux -bash: history: [pid:3016 uid:0] cat 
/etc/passwd

I have try SNARE Agent, it's very helpful. You can filter and log all 
process activity, any file access, network access.... but require some CPU 
charge...
Perhaps, someone have test this software ? Do you have some advices about 
SNARE's configuration ?

Regards,
----------------------------------------------------------------------
David Bigot - Consultant sécurité
Apogée Communications - Groupe DEVOTEAM
86, rue Anatole France
92300 Levallois-Perret
téléphone: ()1.41.49.58.04
email: [email protected]



Mike Blomgren <[email protected]> 
12/11/2007 15:47

A
[email protected], [email protected]
cc

Objet
Re: [logs] How to log - commands and file access






Hi,

To log all commands from bash I have used Bash-BOFH. Found here: 
http://www.ccitt5.net/archives/

It patches the bash source to send all commands to a syslog. It works very 
well, but unfortunately requires bash 2.05, and doesn't work for  the 
newer 3.0 AFAIK.

~Mike


[email protected] wrote: 

Hello,

I want to known for a customer, how to log automatically on UNIX and Linux 
system :
- all commands executed (in BASH, ZSH & co ...). I know but the file 
~/.(ba)sh_history but I prefer a global file or through syslog.
- all file access by process and username in real-time (not static) or if 
it's not possible, which process and username access to some files (or 
directory) like /etc/shadow, /data/ ...

Regards, 
----------------------------------------------------------------------
David Bigot - Consultant sécurité
Apogée Communications - Groupe DEVOTEAM
86, rue Anatole France
92300 Levallois-Perret
téléphone: ()1.41.49.58.04
email: [email protected] 


_______________________________________________
LogAnalysis mailing list
[email protected]
http://www.loganalysis.org/mailman/listinfo/loganalysis

_______________________________________________
LogAnalysis mailing list
[email protected]
http://www.loganalysis.org/mailman/listinfo/loganalysis