Auditing Application Configurations

With SA you can audit configuration files on servers to determine whether or not those files meet your organization’s configuration standards. You can create audit rules that specify how a configuration file on your servers should be defined and audit those servers regularly to check that a configuration file is configured properly. If you find a mismatch between the audit rule definition and the target configuration file values, you can remediate the servers to fix the problem.

For example, to ensure that an /etc/hosts file on a managed server only defines certain host names for a specific IP address, you can define an audit rule that specifies the acceptable list of host name and IP address pairs. When you run the audit, if the hosts file contains any values other than what you specified in the rule, the audit results will show an error and you can remediate the problem.

The general process of auditing application configurations follows these steps:

1. Create an Audit and Audit Rule: To audit a configuration file on a server, you first create an audit. When you create the audit, you specify a source server (or a snapshot or a snapshot specification) upon which the configuration rule will be based. Then you select an application configuration template to construct the rule. The rule defines the exact values you want to check in the target configuration files. For each audit rule, specify the location of the configuration file on the target server.
2. Select Target Servers: In the audit, select the target servers for the audit. You can select a single server, multiple servers, or groups of servers.
3. Run or Schedule the Audit: You can schedule the audit to run once or on a recurring basis. You can also specify email addresses where audit results will be sent.
4. Check Audit Results: Check the audit results to see if the configuration files on the target servers match the values defined in the audit rule. If there are discrepancies, you can compare the rule and the target file to see the differences so you can decide how to remediate the servers.
5. Remediate Servers: To fix any differences found in the audit results, you can remediate the servers or any of the rules or all of the rules, to ensure that the target configuration matches the rule.

For more information on using audits and snapshots, see the "Audit and Remediation" section in the the SA 10.51 Administer section.