IRIX Base Documentation 2001 May

home *** CD-ROM | disk | FTP | other *** search

/ IRIX Base Documentation 2001 May / SGI IRIX Base Documentation 2001 May.iso / usr / share / catman / a_man / cat1 / satd.z / satd

Wrap

Text File | 2001-04-17 | 14.0 KB | 331 lines

ssssaaaattttdddd((((1111MMMM)))) ssssaaaattttdddd((((1111MMMM)))) NNNNAAAAMMMMEEEE satd - reliably save the system audit trail SSSSYYYYNNNNOOOOPPPPSSSSIIIISSSS ssssaaaattttdddd [ ----iiiioooovvvvyyyy1111 ] [ ----ffff path ... ] [ ----rrrr replacement-mode ] [ ----ssss file-size ] DDDDEEEESSSSCCCCRRRRIIIIPPPPTTTTIIIIOOOONNNN _s_a_t_d saves its input data in the directories and/or files named in its path arguments. When one output path becomes full, _s_a_t_d replaces the current output path with a path that is not full. The method of replacement is configurable with the ----rrrr option. The output path is also replaced if _s_a_t_d receives a SSSSIIIIGGGGHHHHUUUUPPPP signal, for instance one sent with a kkkkiiiillllllll ----1111 command. If an output path becomes nearly full, warnings are displayed to the system console to notify the administrator to move the audit trail to tape. If all of the output paths become completely full, the system state is changed to single-user mode after a very short grace period. During the grace period, _s_a_t_d writes its records to /_s_a_t/_s_a_t_d._e_m_e_r_g_e_n_c_y- <_n>, where <_n> is an integer that is incremented for each file created. The system uses the file /_s_a_t/_s_a_t_d._r_e_s_e_r_v_e to maintain space for the emergency files. See _a_u_d_i_t(1M) or the _I_R_I_X _A_d_m_i_n: _B_a_c_k_u_p, _S_e_c_u_r_i_t_y, _a_n_d _A_c_c_o_u_n_t_i_n_g guide for more information on configuring the audit subsystem. OOOOPPPPTTTTIIIIOOOONNNNSSSS ----ffff _p_a_t_h Specify an output path, which can be a directory or a file. If the output path is a directory, _s_a_t_d creates and fills uniquely named files under that directory. (Files are named for the time of their creation. For instance, file _s_a_t__1_9_9_1_0_1_2_3_1_6_3_6 or _s_a_t__9_1_0_1_2_3_1_6_3_6 (if ----yyyy option has been specified) was created in 1991, on January 23 at 4:36 p.m.) If the output path is a file, _s_a_t_d writes to that file. If at any time _s_a_t_d receives a SSSSIIIIGGGGHHHHUUUUPPPP signal, _s_a_t_d will stop writing to the current file and create a new file with the new file name incorporating the current time stamp. When specifying several output paths in the command line, precede each one with a ----ffff (as in example 1) or put commas (but no white space) between each pathname. Taken together, all of the output paths specified in the command line are known as the _p_a_t_h _l_i_s_t. If no output paths are specified and the ----oooo option is not specified, the audit trail records are not saved anywhere, and the system is halted. If a path given as a command line parameter is invalid for any reason, a warning is printed, that path is omitted from the path list, and _s_a_t_d continues operating with whatever specified paths are valid. PPPPaaaaggggeeee 1111 ssssaaaattttdddd((((1111MMMM)))) ssssaaaattttdddd((((1111MMMM)))) If the specified path does not already exist, _s_a_t_d creates a file with that name. A file or directory is full when the filesystem on which it resides has no more available space. If a directory is specified as an output path, an audit file is constructed under that directory. When the audit file is filled to a specified maximum size, it is closed and a new audit file is created under that directory. ----iiii Input audit records from standard input instead of obtaining them from the kernel audit subsystem. ----oooo Output audit records to standard output as well as to the output paths specified with the ----ffff option. Use this option to pipe the audit trail to audit tools from _s_a_t_d. If the ----oooo option is given in the command line, and no output paths are specified, the audit trail is copied to standard output, but it is not saved to a mass storage device. If the ----oooo option is absent from the command line, and no output paths are specified, _s_a_t_d takes records from the kernel audit subsystem, but discards them unused. ----rrrr _r_e_p_l_a_c_e_m_e_n_t-_m_o_d_e The replacement mode can be either pppprrrreeeeffffeeeerrrreeeennnncccceeee, rrrroooottttaaaattttiiiioooonnnn, or oooonnnneeeeppppaaaassssssss. The default replacement mode is pppprrrreeeeffffeeeerrrreeeennnncccceeee. If the replacement mode option appears more than once in the command line, _s_a_t_d prints an error message and exits. If the replacement mode is rrrroooottttaaaattttiiiioooonnnn, _s_a_t_d replaces output paths in a circular order. When the current output path is full, _s_a_t_d writes records to the next path in the list. When the last output path is full, _s_a_t_d writes records to the first path again. If at any time _s_a_t_d receives a SSSSIIIIGGGGHHHHUUUUPPPP signal, _s_a_t_d replaces the current output path with the next path in the order of rotation. If the replacement mode is pppprrrreeeeffffeeeerrrreeeennnncccceeee, _s_a_t_d always uses the available output path closest to the beginning of the path list. When the current output path is full, _s_a_t_d tries to write records to the first path again. _s_a_t_d only writes records to a path if all of the paths preceding it in the list are full. If at any time _s_a_t_d receives a SSSSIIIIGGGGHHHHUUUUPPPP signal, _s_a_t_d replaces the current output path with the next path in the order of preference. If the replacement mode is oooonnnneeeeppppaaaassssssss, _s_a_t_d replaces output paths in a linear order. It uses the output paths in the order they are specified in the command line. If a SSSSIIIIGGGGHHHHUUUUPPPP signal is sent to _s_a_t_d before the end of the path list is reached, _s_a_t_d starts again from the beginning of the list. If _s_a_t_d reaches the end of the path list before receiving a SSSSIIIIGGGGHHHHUUUUPPPP signal, it halts the system immediately. PPPPaaaaggggeeee 2222 ssssaaaattttdddd((((1111MMMM)))) ssssaaaattttdddd((((1111MMMM)))) ----ssss _f_i_l_e-_s_i_z_e The size of the audit file in Kilobytes can be specified to be greater than the default of 4 Megabytes. For example ----ssss 5555000000000000 specifies a maximum audit file size of 5 Megabytes. ----vvvv Verbose indications of activity are printed to standard error. ----yyyy Use a two-digit-year (sat_YYDDMMhhmm) for _s_a_t_d output files. Default _s_a_t_d output files are in four-digit-year file format (sat_YYYYDDMMhhmm). ----1111 Input data is consumed until the first time a _s_a_t_r_e_a_d system call returns with less data read than requested. When the first partial buffer is read, _s_a_t_d exits. The ----1111 option is used in debug and testing to flush the kernel audit buffers. FFFFIIIILLLLEEEESSSS /sat/satd.emergency-0 "emergency" audit file, -0 through -9 /sat/satd.reserve file to reserve 250,000 bytes for above /etc/init.d/audit system audit startup script /etc/config/audit configuration file, oooonnnn if auditing is enabled /etc/config/sat.options optional file for site-dependent satd options /var/adm/sat default directory, specified in /_e_t_c/_i_n_i_t._d/_a_u_d_i_t DDDDIIIIAAAAGGGGNNNNOOOOSSSSTTTTIIIICCCCSSSS satd - ignoring path <_p_a_t_h_n_a_m_e> The specified output path doesn't exist or is not usable. _s_a_t_d ignores it and trying the next entry in the path list. path is neither directory, nor disk file The specified output path can't be used because it isn't one of the object types understood by _s_a_t_d. _s_a_t_d ignores the path and tries the next entry in the path list. Onepass path search complete All the entries in the output path have been used. Since _s_a_t_d has nowhere to put its audit records, it exits. Preference path search fails None of the entries in the output path are available for use. Since _s_a_t_d has nowhere to put its audit records, it exits. Rotation path search fails None of the entries in the output path are available for use. Since _s_a_t_d has nowhere to put its audit records, it exits. can't fstatfs <_p_a_t_h_n_a_m_e> The specified output path doesn't exist or is in an unreadable directory. _s_a_t_d ignores it and tries the next entry in the path list. PPPPaaaaggggeeee 3333 ssssaaaattttdddd((((1111MMMM)))) ssssaaaattttdddd((((1111MMMM)))) path N percent full The auditor is advised to prepare to move the output file to permanent storage, because the output path will become full soon. can't open <_p_a_t_h_n_a_m_e> The specified output path can't be opened for write access, either because it doesn't exist, or because it has restrictive permissions. opening path <_p_a_t_h_n_a_m_e> The specified output path is being opened for use. This message is only seen if _s_a_t_d was invoked with the ----vvvv option (verbose mode). closing directory file <_p_a_t_h_n_a_m_e> The filenamed in this message is being closed. If room remains in the filesystem, a new file is opened in the same directory. The auditor is advised to move the output file to permanent storage. null path pointer An internal error has been encountered in _s_a_t_d. opened full path <_p_a_t_h_n_a_m_e> The specified output path was opened, but it cannot be written because there is no space on the device. It is closed, and the next entry in the path list is tried. Valid directory path but can't open file An internal error has been encountered in _s_a_t_d. satd - sighup received A SSSSIIIIGGGGHHHHUUUUPPPP signal was caught, informing _s_a_t_d to replace the current output path with another path from the list. The new path is chosen in accordance with the replacement strategy specified by the auditor with the ----rrrr command line option. This message is only seen if _s_a_t_d was invoked with the ----vvvv option (verbose mode). satd - X asked but Y written Although _s_a_t_d tried to write X bytes of data, it succeeded in writing only Y bytes. Only use one replacement strategy at a time More than one ----rrrr option was provided as a command line option. The three replacement strategies (onepass, preference, and rotation) are mutually exclusive. Reinvoke _s_a_t_d with consistent command line arguments. Can't read sat buffer Audit records can't be obtained from the kernel sat subsystem, probably due to insufficient privilege or access rights. Can't write sat buffer Even though _s_a_t_d was invoked with the ----oooo command line option, it cannot write audit records to standard output. PPPPaaaaggggeeee 4444 ssssaaaattttdddd((((1111MMMM)))) ssssaaaattttdddd((((1111MMMM)))) Can't send sat buffer Even though the output path has been opened successfully and is not full, _s_a_t_d cannot write audit records to the path. SSSSEEEEEEEE AAAALLLLSSSSOOOO kill(1), mkdir(1), mknod(1M), sat_interpret(1M), sat_reduce(1M), sat_select(1M), sat_summarize(1M), satread(2). PPPPaaaaggggeeee 5555