Example of Monitoring Global Shell Audit Logs

The following example monitors the commands entered by an end user who logs into a managed server with a Remote Terminal session:

1. In a terminal window, as root, log into the core server running the OGFS. The following steps refer to this window as the “auditing window.”
2. In the auditing window, go to the audit/event directory:

   cd /var/opt/opsware/ogfs/mnt/audit/event/ogfs-host

3. In the SA Client, open a Remote Terminal to a UNIX managed server.
4. In the auditing window, examine the last line in the audit.log file:

   tail -1 audit.log.n

   For example, the following entry from the audit.log file indicates that the SA user jdoe opened a Remote Terminal to the host (Device.Name) toro.example.com. The event ID is jdoe@m235:060413184452579:59.

   jdoe@m235:060413184452595:60 jdoe@m235:060413184452579:59 2006/04/13-18:44:52.728 User.Id=6220044 User.Name=jdoe Hub:1.1 GlobalShellAgentLogin 1 OK Device.Id=840044 Device.Name=toro.example.com ConnectMethod=JUMP RemotePath= RemoteUser=root

5. In the auditing window, go to the audit/streams directory:

   cd /var/opt/opsware/ogfs/mnt/audit/streams/ogfs-host

6. In the auditing window, use the tail -f command to monitor the file that corresponds to the Remote Terminal session. The file name is the same as the event ID. For example, if the event ID is jdoe@m235:060413184452579:59, then you would enter the following command:

   tail -f jdoe*59

7. In the Remote Terminal window, enter some UNIX commands such as pwd and ls.
8. Watch the auditing window. The commands (and their output) from the Remote Terminal session are written to the file in the audit/streams directory.