Simple log audit for Linux

Production Environment Log Audit solution

The so-called log audit, is to record all systems and related user behavior, and can automatically analyze, process, display (including text or video)

1): Full log audit via environment variables and Rsyslog service (information too large, not recommended)

2) sudo configuration Rsyslog Service, log audit (less information, good results)

3) Embed a monitor in the Bash interpreter to allow all audited system users to use the modified Special bash program to increase the monitor as an interpreter.

4) Saiji's fortress machine: Commercial Products

In this document, we learn the second method: sudo log audit, the so-called Suod log audit, do not record the operation of ordinary users, only remember to perform sudo command operation

1 Installing sudo and syslog services

Use commands like Yum to install sudo and syslog services online (syslog for Rsyslog service in centos6.4)

2 Configuring/etc/sudoers

Configure the following line in the/etc/sudoers

Defaults Logfile=/var/log/sudo.log

3 Configuring the System log/etc/(R) syslog.conf

Add the following line of configuration files in/etc/syslog.conf

Local2.debug/var/log/sudo.log

4 Restart Syslog Service

/etc/init.d/rsyslog restart

Users who use the sudo command can then be found in/var/log/sudo.log.

It is a very practical method to be tested.

Simple log audit for Linux