RE: process accounting

From: Small, Jim (jim.small_at_eds.com)
Date: 05/30/03

  • Next message: Petty, Robert: "Linux firewall/IDS/NAT suggestions"
    To: focus-linux@securityfocus.com
    Date: Thu, 29 May 2003 19:33:22 -0400
    
    

    Well it depends on how you do it. With Solaris' BSM, the performance
    penalty is 5-10%. IMHO, peanuts compared to the wealth of information you
    can obtain from logging execs. Not just for malicious acts, but also for
    honest mistakes when people are sure what they did or what happened.

    <> Jim

    -----Original Message-----
    wouldn't there be a big overhead if you log every execve() call ?


  • Next message: Petty, Robert: "Linux firewall/IDS/NAT suggestions"

    Relevant Pages

    • Re: Experiences using enhanced Solaris features: BSM, extended ACLs, RBAC
      ... Regarding BSM you can start with the blueprint configuration and ... optimize it with some statistical works over your logfiles. ... RBAC could help a lot in Solaris only environment. ... >reviews of Solaris security from both audit and consulting perspectives. ...
      (Focus-SUN)
    • Re: BSM and syslog... why should I consider the first?
      ... >consider logging via BSM and not syslog. ... >logging in different UNIX OSes easily if I use it. ... >Is there some breaking feature which could make me prefer BSM? ... BSM is auditing for Solaris, ...
      (Focus-SUN)
    • Re: Experiences using enhanced Solaris features: BSM, extended ACLs, RBAC
      ... but BSM is often like Pandora's box. ... data storage and a plan for processing the audit results and ... Subject: Experiences using 'enhanced' Solaris features: BSM, extended ACLs, RBAC ...
      (Focus-SUN)
    • Re: Can we expect our rates to go up now?
      ... > apparent to all who care to look, is to enforce an extraction of wealth. ... > Just think of any law who's punishment is a fine or financial penalty as ... > a "stealth tax". ... If the law were actually meant to prevent the ...
      (rec.outdoors.rv-travel)
    • Re: Can we expect our rates to go up now?
      ... apparent to all who care to look, is to enforce an extraction of wealth. ... Just think of any law who's punishment is a fine or financial penalty as ... a "stealth tax". ...
      (rec.outdoors.rv-travel)