Auditing Users

By default, when system auditing is on, the audit status for all users is on. New users added to the system are automatically audited.

You can monitor what users are doing on HP-UX systems using the auditing. To change which users are audited, choose one of the following options:

Audit all users.
By default, audit status for all users is set to on when the audit system is turned on. New users added to the system are automatically audited.
If auditing is turned off for all users, set AUDIT_FLAG=1 in the /etc/default/security file.
Do not audit any users.
To turn off auditing for all users, follow these steps:
1. Check to see which users are already being audited. To check, follow these steps:
  Check the AUDIT_FLAG setting in the /etc/default/security file.
  Check the AUDIT_FLAG setting stored in the user database using the following command:
  # userdbget -a AUDIT_FLAG
2. Set AUDIT_FLAG=0 in the /etc/default/security file.
Audit specific users. To configure auditing for specific users, follow these steps:
1. Deselect auditing for all users by setting the AUDIT_FLAG=0 in the /etc/default/security file.
2. Configure auditing for a specific user using the following command:
  # /usr/sbin/userdbset -u user-name AUDIT_FLAG=1.

If the audit system is not already enabled, use the audsys -n command to start the auditing system. Auditing changes take effect at the user's next login.

Auditing Users

Technical documentation

» Table of Contents

» Glossary

» Index