execs is not passed to the audit_syslog.so plugin
edited Dec 27, 2012 11:21PM in Oracle Solaris File Systems and Disk Management (MOSC) 1 commentAnswered ✓
My OS is Solaris 10 on SPARC platform. I have configured BSM auditing and send audit log to syslog server. Argv policy is used but it seems that the argv from execs is not passed to the audit_syslog.so plugin. For example:
When i run command "ls -al", message received in syslog server likes below:
Dec 26 07:06:51 bjapndns01.bj.bgan.inmarsat.com audit: [ID 702911 audit.notice] execve(2) ok session 2756615267 by ericuser as root:root from bjnmc01.bj.bgan.inmarsat.com obj /usr/bin/ls
When i run command "ls -al", message received in syslog server likes below:
Dec 26 07:06:51 bjapndns01.bj.bgan.inmarsat.com audit: [ID 702911 audit.notice] execve(2) ok session 2756615267 by ericuser as root:root from bjnmc01.bj.bgan.inmarsat.com obj /usr/bin/ls
BSM audit provides obj /usr/bin/ls only
The message is missing argv "-al".
Is there any bug to resolve this issue?
0