Auditing questions

[ski98033]

Hi,

I am confused on auditing. Questions I have are:

1. The audit log has settings for smtpd, omoff, omon, user-agent signoff, user-agent signon, web-client, but I cannot see how to turn on auditing for these items. For example omconfaud smtpd 1 gives the following error:

omconfaud : [OM 4910] Sub-system does not have a log level: 'SMTP Relay'

2. Why are there multiple sections for the 'net' service? Can I turn these different sections on and off separately somehow?

3. What about all the daemons and services that are listed via omshowaud, but that are not in the configuration file? What are the audit levels for these daemons and services?

ski

[Valerion]

omconfaud -a "smtp relay" 15 works for me. Use omshowlvl -l to get a list of abbreviations for services and daemons.

[gregory]

Hi Ski,

I put some information together to explain audit logging, hope it helps

http://www.scalix.com/wiki/index.php?title=User_talk:Greg

Cheers

Gregor

[chrstnsln22]

Hi Gregor, Thanks for the link.. I've tried almost everything that I can think of but to no avail until I found your link.



Christine