Is it possible to audit a specific folder or file in Solaris ?

ycheng08 · July 27, 2011, 10:11am

Hi,

I wish to audit access to a specific folder or file in Solaris.

I have read the man pages for auditd, audit_control , audit_event but don't seem to find any clue.

Has anyone tried this before ? Is it feasible ?

Any advise is appreciated.

Thanks

Yik

joeyg · July 27, 2011, 10:37am

What exactly do you mean by 'audit'?
What are you trying to determine/learn?

vivek.goel.piet · July 27, 2011, 11:05am

Dude,Please explain whats ur purpose..What do u want to do by these commands?..Pelase provide specific details so that we can help u out

ycheng08 · July 27, 2011, 12:40pm

I wish to track user access to specific files or folders e.g. /etc
and log the information to syslog.

I understand the Solaris BSM auditing can do that but not sure if it
can be tuned to audit only desired files or directories.

william1872 · July 27, 2011, 1:45pm

Process accounting in Solaris can do what your looking for...

ycheng08 · July 28, 2011, 10:42am

Thanks William. I will test it out.