I am trying to set up audit trail for our company server. (Mac OS X Server 10.3.9) We would like to record the activity of standard, non-administrative, users. We would like to record file creation, modification, deletion, among other things. We have installed the common criteria tools, but the seem to only record administrative users' activity.
Does anybody know how to implement this type of audit?
Thanks.
It can audit all activities on Mac OS X, you just need to tell it what to audit. E.g. file deletion corresponds to the fd class.
If you give me a list of things you want to audit, I can help you put together a suitable audit policy.
Thanks for your response. We are trying to audit the actions of non-admin users who access the shared volumes in the server. The actions we would like to record are: file creation, file deletion, file modification. We would also like to record directory creation, deletion and modification.
We are basically failing to record anything that has not been performed by an admin user.
Thanks again for the response to my question.
To audit file (and directory) creation deletion and modification, you should add the following flags to the flags: line in audit_control so it reads:
flags: lo,fm,fc,fd
If you have an admin user who isn't generating these records, find the pid of the shell and run:
auditconfig -getpinfo pid