path: root/zh_CN.GB2312/books/handbook/audit/chapter.sgml

<!--
     The FreeBSD Documentation Project
     The FreeBSD Simplified Chinese Project

     Original Revision: 1.33
     $FreeBSD$
-->

<!-- Need more documentation on praudit, auditreduce, etc.  Plus more info
on the triggers from the kernel (log rotation, out of space, etc).
And the /dev/audit special file if we choose to support that.  Could use
some coverage of integrating MAC with Event auditing and perhaps discussion
on how some companies or organizations handle auditing and auditing
requirements. -->

<chapter id="audit">
  <chapterinfo>
    <authorgroup>
      <author>
	<firstname>Tom</firstname>
	<surname>Rhodes</surname>
	<contrib>Ô­×÷ </contrib>
      </author>
      <author>
	<firstname>Robert</firstname>
	<surname>Watson</surname>
      </author>
    </authorgroup>
  </chapterinfo>

  <title>°²È«Ê¼þÉó¼Æ</title>

  <sect1 id="audit-synopsis">
    <title>¸ÅÊö</title>

    <indexterm><primary>AUDIT</primary></indexterm>
    <indexterm>
      <primary>°²È«Ê¼þÉó¼Æ</primary>
      <see>MAC</see>
    </indexterm>

    <para>&os; 6.2 ºÍ¸ü¸ß°æ±¾Öаüº¬Á˶ÔÓÚϸÁ£¶È°²È«Ê¼þÉó¼ÆµÄÖ§³Ö¡£
      ʼþÉó¼ÆÄܹ»Ö§³Ö¿É¿¿µÄ¡¢ ϸÁ£¶ÈÇÒ¿ÉÅäÖõģ¬ ¶ÔÓÚ¸÷ÀàÓ밲ȫÓйصÄϵͳʼþ£¬
	  °üÀ¨µÇ¼¡¢ ÅäÖñä¸ü£¬ ÒÔ¼°ÎļþºÍÍøÂç·ÃÎʵȵÄÈÕÖ¾¼Ç¼¡£
	  ÕâЩÈÕÖ¾¼Ç¼¶ÔÓÚÔÚÕýÔÚÔËÐеÄϵͳÉÏʵʩ¼à¿Ø¡¢ ÈëÇÖ¼ì²âºÍʺó·ÖÎö¶¼Ê®·ÖÖØÒª¡£
      &os; ʵÏÖÁË Sun Ëù·¢²¼µÄ
      <acronym>BSM</acronym> API ºÍÎļþ¸ñʽ£¬ ²¢ÇÒÓë &sun; µÄ &solaris;
	  ºÍ &apple; µÄ &macos; X Éó¼ÆʵÏÖ¼æÈÝ¡£</para>

    <para>ÕâÒ»ÕµÄÖصãÊÇ°²×°ºÍÅäÖÃʼþÉó¼Æ¡£ Ëü½éÉÜÁËʼþ²ßÂÔ£¬ ²¢ÌṩÁËÒ»¸öÉó¼ÆµÄÅäÖÃÀý×Ó¡£</para>

    <para>¶ÁÍêÕâÕ£¬ Äú½«Á˽⣺</para>

    <itemizedlist>
      <listitem>
        <para>ʼþÉó¼ÆÊÇʲô£¬ ÒÔ¼°ËüÈçºÎ¹¤×÷¡£</para>
      </listitem>

      <listitem>
	<para>ÈçºÎÔÚ &os; ÉÏΪÓû§ºÍ½ø³ÌÅäÖÃʼþÉó¼Æ¡£</para>
      </listitem>

      <listitem>
	<para>ÈçºÎʹÓÃÉó¼Æ¼Ç¼ժҪºÍ¸´É󹤾ßÀ´¶ÔÉó¼Æ¼Ç¼½øÐи´Éó¡£</para>
      </listitem>
    </itemizedlist>

    <para>ÔĶÁÕâÕÂ֮ǰ£¬ ÄúÓ¦¸Ã£º</para>

    <itemizedlist>
      <listitem>
	<para>Àí½â &unix; ºÍ &os; µÄ»ù´¡ÖªÊ¶
	  (<xref linkend="basics">)¡£</para>
      </listitem>

      <listitem>
	<para>ÊìϤ¹ØÓÚÄÚºËÅäÖúͱàÒëµÄ»ù±¾·½·¨
	  (<xref linkend="kernelconfig">)¡£</para>
      </listitem>

      <listitem>
	<para>ÊìϤ°²È«ÖªÊ¶ÒÔ¼°ÈçºÎÔÚ &os; ÔËÓÃËüÃÇ (<xref linkend="security">)¡£</para>
      </listitem>
    </itemizedlist>

    <warning>
      <para>ÔÚ &os; 6.<replaceable>X</replaceable> ÉϵÄÉó¼Æ»úÖÆÊÇÊÔÑéÐԵģ¬
	ÔÚÉú²ú»·¾³Öв¿Êð֮ǰ£¬ Ó¦×ÐϸÆÀ¹À²¿ÊðÊÔÑéÐÔÈí¼þ¿ÉÄÜ´øÀ´µÄ·çÏÕ¡£ ÒÑÖªµÄÏÞÖÆÊÇ£¬
	²¢²»ÊÇËùÓÐÓ밲ȫÓйصÄϵͳʼþ¶¼ÊÇ¿ÉÉó¼ÆµÄ£¬ ijЩµÇ¼»úÖÆ£¬ ÀýÈç»ùÓÚ X11
	ÏÔʾ¹ÜÀíÆ÷£¬ ÒÔ¼°µÚÈý·½·þÎñµÄµÇ¼»úÖÆ£¬ ¶¼²»»áÔÚÓû§µÄµÇ¼»á»°ÖÐÕýÈ·ÅäÖÃÉó¼Æ¡£</para>
    </warning>

    <warning>
      <para>°²È«Éó¼Æ»úÖÆÄܹ»¶Ôϵͳ»î¶¯Éú³É·Ç³£ÏêϸµÄ¼Ç¼ÐÅÏ¢£º ÔÚ·±Ã¦µÄϵͳÖУ¬
	¼ÇÕÊÊý¾ÝÈç¹ûÅäÖò»µ±»á·Ç³£µÄ´ó£¬ ²¢ÔÚÒ»ÖÜÄÚѸËÙ³¬¹ý¼¸¸ö GB µÄ³ß´ç¡£
	¹ÜÀíÔ±Ó¦¿¼ÂÇÉó¼ÆÅäÖÃÖеĵ¼Ö´ÅÅÌ¿Õ¼äÐèÇóµÄÕâЩÎÊÌâ¡£ ÀýÈ磬
	¿ÉÄÜÐèҪΪ <filename>/var/audit</filename> Ŀ¼µ¥¶À·ÖÅäÒ»¸öÎļþϵͳ£¬
	ÒÔ·ÀÖ¹ÔÚÉó¼ÆÈÕÖ¾ËùÓõÄÎļþϵͳ±»ÌîÂúʱӰÏìÆäËüÎļþϵͳ¡£</para>
    </warning>

  </sect1>

  <sect1 id="audit-inline-glossary">
    <title>±¾ÕÂÖеÄһЩ¹Ø¼üÊõÓï</title>

    <para>ÔÚ¿ªÊ¼ÔĶÁÕâÕÂ֮ǰ£¬ ÎÒÃÇÐèÒª½âÊÍÒ»ÏÂÓëÉó¼ÆÓйصÄһЩ¹Ø¼üµÄÊõÓ</para>

    <itemizedlist>
      <listitem>
	<para><emphasis>ʼþ (event)</emphasis>£º
	  ¿ÉÉó¼ÆʼþÊÇÖ¸Äܹ»±»Éó¼Æ×Óϵͳ¼Ç¼µÄÈκÎʼþ¡£
	  ¾ÙÀý˵À´£¬ Ó밲ȫÓйصÄʼþ°üÀ¨´´½¨Îļþ¡¢
	  ½¨Á¢ÍøÂçÁ¬½Ó£¬ ÒÔ¼°ÒÔijһÓû§Éí·ÝµÇ¼£¬ µÈµÈ¡£
	  ÈκÎʼþ±ØҪôÊÇ <quote>ÓÐÖ÷ (attributable)</quote> µÄ£¬
	  ¼´¿ÉÒÔ×îÖÕ¹éÓÚijһÒÑͨ¹ýÑéÖ¤µÄÓû§µÄÉí·Ý£¬ ·´Ö®£¬ Ôò³Æ¸ÃʼþÊÇ
	  <quote>ÎÞÖ÷ (non-attributable)</quote> µÄ¡£
	  ÎÞÖ÷ʼþ¿ÉÒÔÊÇ·¢ÉúÔڵǼ¹ý³Ì³É¹¦Ö®Ç°µÄÈκÎʼþ£¬ ÀýÈç³¢ÊÔÒ»´ÎÎÞЧÃÜÂëµÈ¡£</para>
      </listitem>

      <listitem>
        <para><emphasis>Àà (class)</emphasis>£º ʼþÀàÊÇÖ¸Ïà¹ØʼþµÄÒ»¸öÃüÃû¼¯ºÏ£¬
	  ͨ³£ÔÚɸѡ±í´ïʽÖÐʹÓᣠ³£ÓõÄʼþÀà°üÀ¨ <quote>´´½¨Îļþ</quote> (fc)¡¢
	  <quote>Ö´ÐÐ</quote> (ex) ºÍ <quote>µÇÈëºÍ×¢Ïú</quote>
	  (lo)¡£</para>
      </listitem>

      <listitem>
	<para><emphasis>¼Ç¼ (record)</emphasis>£º ¼Ç¼ÊÇÖ¸ÃèÊöÒ»¸ö°²È«Ê¼þµÄÈÕÖ¾Ïî¡£
	  ¼Ç¼°üÀ¨¼Ç¼Ê¼þÀàÐÍ¡¢ Ö´ÐвÙ×÷µÄÖ÷Ìå (Óû§) ÐÅÏ¢¡¢
	  ÈÕÆÚºÍʼþÐÅÏ¢£¬ ÒÔ¼°ÓëÖ®Ïà¹ØµÄ¶ÔÏó»ò²ÎÊýÐÅÏ¢£¬ ×îºóÊDzÙ×÷³É¹¦»òʧ°Ü¡£</para>
      </listitem>

      <listitem>
	<para><emphasis>ÕËÄ¿ (trail)</emphasis>£º Éó¼ÆÕËÄ¿£¬ »òÈÕÖ¾Îļþ£¬
	  °üº¬ÁËһϵÁÐÃèÊö°²È«Ê¼þµÄÉó¼Æ¼Ç¼¡£ µäÐÍÇé¿öÏ£¬
	  Éó¼ÆÕËÄ¿»ù±¾ÉÏÊÇÒÔʼþ·¢ÉúµÄʱ¼ä˳Ðò¼Ç¼µÄ¡£ Ö»ÓлñµÃÊÚȨµÄ½ø³Ì£¬
	  ²ÅÄܹ»ÏòÉó¼ÆÕËÄ¿ÖÐÌá½»¼Ç¼¡£</para>
      </listitem>

      <listitem>
	<para><emphasis>ɸѡ±í´ïʽ (selection expression)</emphasis>£º
	  ɸѡ±í´ïʽÊÇ°üº¬Ò»ÏµÁÐǰ׺ºÍÉó¼ÆʼþÀàÃû×Ö£¬
	  ÓÃÒÔÆ¥ÅäʼþµÄ×Ö·û´®¡£</para>
      </listitem>

      <listitem>
	<para><emphasis>Ԥѡ (preselection)</emphasis>£º ϵͳͨ¹ýÕâÒ»¹ý³ÌÀ´Ê¶±ðʼþÊÇ·ñÊǹÜÀíÔ±Ëù¸ÐÐËȤµÄ£¬
	  ´Ó¶ø±ÜÃâΪËûÃDz»¸ÐÐËȤµÄʼþÉú³É¼Ç¼¡£ ԤѡÅäÖÃʹÓÃһϵÁÐÑ¡Ôñ±í´ïʽ£¬
	  ÓÃÒÔʶ±ðʼþÀà±ð¡¢ ÒªÉó¼ÆµÄÓû§£¬ ÒÔ¼°ÊÊÓÃÓÚÑéÖ¤¹ýÓû§Éí·Ý£¬ ÒÔ¼°Î´ÑéÖ¤Óû§Éí·ÝµÄ½ø³ÌµÄÈ«¾ÖÅäÖá£</para>
      </listitem>

      <listitem>
	<para><emphasis>ŨËõ (reduction)</emphasis>£º ´ÓÏÖÓеÄÉó¼Æ¼ÇÕÊÖÐɸѡ³öÓÃÓÚ±£Áô¡¢
	  ´òÓ¡»ò·ÖÎöµÄ¹ý³Ì¡£ ³ý´ËÖ®Í⣬ ËüÒ²±íʾ´ÓÉó¼Æ¼ÇÕÊÖÐɾȥ²»ÐèÒªµÄÉó¼Æ¼Ç¼µÄ¹ý³Ì¡£
	  ͨ¹ýʹÓÃŨËõ²Ù×÷£¬ ¹ÜÀíÔ±¿ÉÒÔʵÏÖÔ¤ÁôÉó¼ÆÊý¾ÝµÄ²ßÂÔ¡£ ÀýÈ磬 ÏêϸµÄÉó¼Æ¼ÇÕÊÐÅÏ¢£¬
	  ¿ÉÄܻᱣÁôÒ»¸öÔÂÖ®¾Ã£¬ µ«ÔÚÕâÖ®ºó£¬ Ôò¶ÔÕâЩ¼ÇÕÊÐÅÏ¢Ö´ÐÐŨËõ²Ù×÷£¬
	  Ö»±£ÁôµÇ¼ÐÅÏ¢ÓÃÓÚ´æµµ¡£</para>
      </listitem>
    </itemizedlist>
  </sect1>

  <sect1 id="audit-install">
    <title>°²×°Éó¼ÆÖ§³Ö</title>

    <para>¶ÔÓÚʼþÉó¼ÆµÄÖ§³Ö£¬ ÒѾ­Ëæ±ê×¼µÄ <maketarget>installworld</maketarget>
      ¹ý³ÌÍê³É¡£ ¹ÜÀíÔ±¿ÉÒÔͨ¹ý²é¿´
      <filename role="directory">/etc/security</filename> µÄÄÚÈÝÀ´È·ÈÏÕâÒ»µã¡£
      ÄúÓ¦ÄÜ¿´µ½Ò»Ð©Ãû×ÖÒÔ <emphasis>audit</emphasis> ¿ªÍ·µÄÎļþ£¬
      ÀýÈç <filename>audit_event</filename>¡£</para>

    <para>Óû§¿Õ¼ä¶ÔʼþÉó¼ÆµÄÖ§³ÖÒѾ­×÷Ϊ &os; »ù±¾ÏµÍ³µÄÒ»²¿·Ö±»°²×°¡£
      ÔÚ &os; 7.0 ºÍÒÔºóµÄ°æ±¾ÖУ¬Äں˶ÔÓÚʼþÉó¼ÆµÄÖ§³ÖÒѱ»Ä¬ÈϱàÒë½øÄںˡ£
      ¶ÔÓÚ &os; 6.<replaceable>X</replaceable>
      ±ØÐë¼ÓÈëÃ÷È·µØ°ÑÒÔÏÂÕâÐмÓÈëÄÚºËÅäÖÃÎļþ²¢±àÒë¡£</para>

    <programlisting>options	AUDIT</programlisting>

    <para>½ÓÏÂÀ´£¬ ÄúÓ¦°´ÕÕ
      <xref linkend="kernelconfig"> ÖÐËù½éÉܵIJ½ÖèÀ´Íê³ÉÒ»´ÎÄں˵ıàÒëºÍ°²×°¡£</para>

    <para>ÔÚ±àÒëºÃ²¢°²×°ÁËÄںˣ¬ ²¢ÖØÐÂÆô¶¯ÁËϵͳ֮ºó£¬ ¾Í¿ÉÒÔÔÚ
      &man.rc.conf.5; ÖÐÔö¼ÓÏÂÁÐÅäÖÃÀ´ÆôÓÃÉó¼Æ·þÎñÁË£º</para>

    <para>ÔÚ±àÒë¡¢°²×°ÁË¿ªÆôÉó¼Æ¹¦ÄܵÄÄںˣ¬²¢ÖØÐÂÆô¶¯¼ÆËã»úÖ®ºó£¬
      ¾Í¿ÉÒÔÔÚ &man.rc.conf.5; ÖÐÔö¼ÓÏÂÁÐÅäÖÃÀ´ÆôÓÃÉó¼Æ·þÎñÁË£º</para>

    <programlisting>auditd_enable="YES"</programlisting>

    <para>´Ëºó£¬ ±ØÐëÖØÐÂÆô¶¯ÏµÍ³£¬ »òͨ¹ýÏÂÃæµÄÃüÁîÊÖ¹¤Æô¶¯Éó¼Æ·þÎñÀ´Æô¶¯Éó¼ÆÖ§³Ö£º</para>

    <programlisting>/etc/rc.d/auditd start</programlisting>
  </sect1>

  <sect1 id="audit-config">
    <title>¶ÔÉó¼Æ½øÐÐÅäÖÃ</title>

    <para>ËùÓÐÓÃÓÚ°²È«Éó¼ÆµÄÅäÖÃÎļþ£¬ ¶¼¿ÉÒÔÔÚ
      <filename class="directory">/etc/security</filename> ÕÒµ½¡£
      ÒªÆô¶¯Éó¼Æ·þÎñ£¬ ÏÂÃæÕâЩÎļþ±ØÐë´æÔÚ£º</para>

    <itemizedlist>
      <listitem>
	<para><filename>audit_class</filename> - °üº¬¶ÔÓÚÉó¼ÆÀàµÄ¶¨Òå¡£</para>
      </listitem>

      <listitem>
	<para><filename>audit_control</filename> - ¿ØÖÆÉó¼Æ×ÓϵͳµÄÌØÐÔ£¬
	  ÀýÈçĬÈÏÉó¼ÆÀà¡¢ ÔÚÉó¼ÆÈÕÖ¾ËùÔڵľíÉϱ£ÁôµÄ×îС¿Õ¼ä¡¢
	  Éó¼ÆÈÕÖ¾µÄ×î´ó³ß´ç£¬ µÈµÈ¡£</para>
      </listitem>

      <listitem>
	<para><filename>audit_event</filename> - ÎÄ×Ö»¯µÄϵͳÉó¼ÆʼþÃû³ÆºÍÃèÊö£¬
	  ÒÔ¼°Ã¿¸öʼþÊôÓÚÄĸöÀà±ð¡£</para>
      </listitem>

      <listitem>
	<para><filename>audit_user</filename> - Õë¶ÔÌض¨Óû§µÄÉó¼ÆÐèÇó£¬
	  ÕâЩÅäÖÃÔڵǼʱ»áÓëÈ«¾ÖµÄĬÈÏÖµºÏ²¢¡£</para>
      </listitem>

      <listitem>
	<para><filename>audit_warn</filename> - ÓÉ <application>auditd</application> µ÷ÓõÄÒ»¸ö¿É¶¨ÖÆµÄ shell
	  ½Å±¾£¬ ÓÃÓÚÔÚÒâÍâÇé¿ö£¬ ÈçÓÃÓÚÉó¼ÆÈÕÖ¾µÄ¿Õ¼ä¹ýÉÙ£¬ »òÉó¼ÆÈÕÖ¾Îļþ±»·­×ªÊ±£¬
	  Éú³É¾¯¸æÐÅÏ¢¡£</para>
      </listitem>
    </itemizedlist>

    <warning>
      <para>Ôڱ༭ºÍά»¤Éó¼ÆÅäÖÃÎļþʱһ¶¨ÒªÐ¡ÐÄ£¬ ÒòΪÅäÖÃÎļþÖеĴíÎó»áµ¼Ö¼Ç¼Ê¼þ²»ÕýÈ·¡£</para>
    </warning>

    <sect2>
      <title>ʼþɸѡ±í´ïʽ</title>

      <para>ÔÚÉó¼ÆÅäÖÃÎļþÖеÄÐí¶àµØ·½»áÓõ½É¸Ñ¡±í´ïʽÀ´È·¶¨ÄÄЩʼþÊÇÐèÒªÉó¼ÆµÄ¡£
	±í´ïʽÖÐÐèÒªÖ¸¶¨ÒªÆ¥ÅäµÄʼþÀàÐÍ£¬ ²¢Ê¹ÓÃǰ׺ָ¶¨ÊÇ·ñÓ¦½ÓÊÜ»òºöÂÔÆ¥ÅäµÄʼþ£¬
	´ËÍ⣬ »¹¿ÉÒÔÖ¸¶¨Ò»¸ö¿ÉÑ¡ÏîÖ¸Ã÷Æ¥Åä³É¹¦»òʧ°ÜµÄ²Ù×÷¡£
	Ñ¡Ôñ±í´ïʽÊÇ°´´Ó×óµ½ÓÒµÄ˳Ðò¼ÆËãµÄ£¬ ¶ø¶ÔÓÚÁ½¸ö±í´ïʽµÄÇéÐΣ¬
	ÔòÊÇͨ¹ý½«ºóÒ»¸ö×·¼Óµ½Ç°Ò»¸öÖ®ºóÀ´ÊµÏֵġ£</para>

      <para>ÏÂÃæÁгöÁËÔÚ <filename>audit_class</filename> ÖеÄĬÈÏʼþÀàÐÍ£º</para>

      <itemizedlist>
	<listitem>
	  <para><literal>all</literal> - <emphasis>all (È«²¿)</emphasis> - ±íʾƥÅäÈ«²¿Ê¼þÀà¡£</para>
	</listitem>

	<listitem>
	  <para><literal>ad</literal> - <emphasis>administrative (¹ÜÀí)</emphasis>
	    - ËùÓÐÔÚϵͳÉÏËù½øÐеĹÜÀíÐÔ²Ù×÷¡£</para>
	</listitem>

	<listitem>
	  <para><literal>ap</literal> - <emphasis>application (Ó¦ÓÃ)</emphasis> -
	    Ó¦ÓóÌÐò¶¨ÒåµÄ¶¯×÷¡£</para>
	</listitem>

	<listitem>
	  <para><literal>cl</literal> - <emphasis>file close (Îļþ¹Ø±Õ)</emphasis> -
	    Éó¼Æ¶Ô <function>close</function> ϵͳµ÷ÓõIJÙ×÷¡£</para>
	</listitem>

	<listitem>
	  <para><literal>ex</literal> - <emphasis>exec (Ö´ÐÐ)</emphasis> - Éó¼Æ³ÌÐòµÄÖ´ÐС£
	    ¶ÔÓÚÃüÁîÐвÎÊýºÍ»·¾³±äÁ¿µÄÉó¼ÆÊÇͨ¹ýÔÚ &man.audit.control.5;
	    ÖÐ <literal>policy</literal> µÄ <literal>argv</literal> ºÍ <literal>envv</literal>
	    ²ÎÊýÀ´¿ØÖƵġ£</para>
	</listitem>

	<listitem>
	  <para><literal>fa</literal> - <emphasis>file attribute access (Ôì·ÃÎļþÊôÐÔ)</emphasis>
	    - Éó¼Æ·ÃÎʶÔÏóÊôÐÔ£¬ ÀýÈç
	    &man.stat.1;¡¢ &man.pathconf.2; ÒÔ¼°ÀàËÆʼþ¡£</para>
	</listitem>

	<listitem>
	  <para><literal>fc</literal> - <emphasis>file create (´´½¨Îļþ)</emphasis>
	    - Éó¼Æ´´½¨ÁËÎļþµÄʼþ¡£</para>
	</listitem>

	<listitem>
	  <para><literal>fd</literal> - <emphasis>file delete (ɾ³ýÎļþ)</emphasis>
	    - Éó¼ÆËù·¢ÉúµÄÎļþɾ³ýʼþ¡£</para>
	</listitem>

	<listitem>
	  <para><literal>fm</literal> - <emphasis>file attribute modify (ÐÞ¸ÄÎļþÊôÐÔ)</emphasis>
	    - Éó¼ÆÎļþÊôÐÔ·¢Éú±ä»¯µÄʼþ£¬
	    ÀýÈç &man.chown.8;¡¢ &man.chflags.1;¡¢ &man.flock.2;£¬
	    µÈµÈ¡£</para>
	</listitem>

	<listitem>
	  <para><literal>fr</literal> - <emphasis>file read (¶ÁÎļþÊý¾Ý)</emphasis>
	    - Éó¼Æ¶ÁÈ¡Êý¾Ý¡¢ ÎļþÒÔ¶Á·½Ê½´ò¿ªµÈʼþ¡£</para>
	</listitem>

	<listitem>
	  <para><literal>fw</literal> - <emphasis>file write (дÎļþÊý¾Ý)</emphasis> -
	    Éó¼ÆдÈëÊý¾Ý¡¢ ÎļþÒÔд·½Ê½´ò¿ªµÈʼþ¡£</para>
	</listitem>

	<listitem>
	  <para><literal>io</literal> - <emphasis>ioctl</emphasis> -
	    Éó¼Æ¶Ô &man.ioctl.2; ϵͳµ÷ÓõÄʹÓá£</para>
	</listitem>

	<listitem>
	  <para><literal>ip</literal> - <emphasis>ipc</emphasis> - Éó¼Æ¸÷ÖÖÐÎʽµÄ½ø³Ì¼äͨÐÅ (IPC)£¬
	    °üÀ¨ POSIX ¹ÜµÀºÍ System V <acronym>IPC</acronym> ²Ù×÷¡£</para>
	</listitem>

	<listitem>
	  <para><literal>lo</literal> - <emphasis>login_logout</emphasis> -
	    Éó¼ÆϵͳÖз¢ÉúµÄ &man.login.1; ºÍ &man.logout.1; ʼþ¡£</para>
	</listitem>

	<listitem>
	  <para><literal>na</literal> - <emphasis>non attributable (ÎÞÖ÷)</emphasis> -
	    Éó¼ÆÎÞ·¨¹éÀàµÄʼþ¡£</para>
	</listitem>

	<listitem>
	  <para><literal>no</literal> - <emphasis>invalid class (ÎÞЧÀà)</emphasis> -
	    ±íʾ²»Æ¥ÅäÈκÎʼþ¡£</para>
	</listitem>

	<listitem>
	  <para><literal>nt</literal> - <emphasis>network (ÍøÂç)</emphasis> -
	    ÓëÍøÂç²Ù×÷ÓйصÄʼþ£¬ ÀýÈç
	    &man.connect.2; ºÍ &man.accept.2;¡£</para>
	</listitem>

	<listitem>
	  <para><literal>ot</literal> - <emphasis>other (ÆäËü)</emphasis> -
	    Éó¼Æ¸÷ÀàÔÓÏîʼþ¡£</para>
	</listitem>

	<listitem>
	  <para><literal>pc</literal> - <emphasis>process (½ø³Ì)</emphasis> -
	    Éó¼Æ½ø³Ì²Ù×÷£¬ ÀýÈç &man.exec.3; ºÍ
	    &man.exit.3;¡£</para>
	</listitem>

      </itemizedlist>

      <para>ÕâЩÉó¼Æʼþ£¬ ¿ÉÒÔͨ¹ýÐÞ¸Ä
	<filename>audit_class</filename> ºÍ
	<filename>audit_event</filename> ÕâÁ½¸öÅäÖÃÎļþÀ´½øÐж¨ÖÆ¡£</para>

      <para>Õâ¸öÁбíÖУ¬ ÿ¸öÉó¼ÆÀà¾ù°üº¬Ò»¸ö±íʾƥÅä³É¹¦/ʧ°Ü²Ù×÷µÄǰ׺£¬
	ÒÔ¼°ÕâÒ»ÏîÊÇ·ñÊÇÔö¼Ó»òɾȥ¶ÔʼþÀà»òÀàÐ͵ÄÆ¥Åä¡£</para>

      <itemizedlist>
	<listitem>
	  <para>(none) Éó¼ÆʼþµÄ³É¹¦ºÍʧ°ÜʵÀý¡£</para>
	</listitem>

	<listitem>
	  <para><literal>+</literal> Éó¼ÆÕâÒ»ÀàµÄ³É¹¦Ê¼þ¡£</para>
	</listitem>

	<listitem>
	  <para><literal>-</literal> Éó¼ÆÕâÒ»ÀàµÄʧ°Üʼþ¡£</para>
	</listitem>

	<listitem>
	  <para><literal>^</literal> ²»Éó¼Æ±¾ÀàÖеijɹ¦»òʧ°Üʼþ¡£</para>
	</listitem>

	<listitem>
	  <para><literal>^+</literal> ²»Éó¼Æ±¾ÀàÖеijɹ¦Ê¼þ¡£</para>
	</listitem>

	<listitem>
	  <para><literal>^-</literal> ²»Éó¼Æ±¾ÀàÖеÄʧ°Üʼþ¡£</para>
	</listitem>

      </itemizedlist>

      <para>ÏÂÃæÀý×ÓÖеÄɸѡ×Ö·û´®±íʾɸѡ³É¹¦ºÍʧ°ÜµÄµÇ¼/×¢Ïúʼþ£¬
	¶ø¶ÔÖ´ÐÐʼþ£¬ ÔòÖ»Éó¼Æ³É¹¦µÄ£º</para>

      <programlisting>lo,+ex</programlisting>

    </sect2>

    <sect2>
      <title>ÅäÖÃÎļþ</title>

      <para>¶àÊýÇé¿öÏ£¬ ÔÚÅäÖÃÉó¼Æϵͳʱ£¬
	¹ÜÀíÔ±Ö»ÐèÐÞ¸ÄÁ½¸öÎļþ£º <filename>audit_control</filename>
	ºÍ <filename>audit_user</filename>¡£ Ç°Õß¿ØÖÆϵͳ¼¶µÄÉó¼ÆÊôÐԺͲßÂÔ£¬
	¶øºóÕßÔòÓÃÓÚÕë¶Ô¾ßÌåµÄÓû§À´Î¢µ÷¡£</para>

      <sect3 id="audit-auditcontrol">
        <title><filename>audit_control</filename> Îļþ</title>

	<para><filename>audit_control</filename> ÎļþÖ¸¶¨ÁËһϵÁÐÓÃÓÚÉó¼Æ×ÓϵͳµÄĬÈÏÉèÖá£
	  ͨ¹ý²é¿´Õâ¸öÎļþ£¬ ÎÒÃÇ¿ÉÒÔ¿´µ½ÏÂÃæµÄÄÚÈÝ£º</para>

	<programlisting>dir:/var/audit
flags:lo
minfree:20
naflags:lo
policy:cnt
filesz:0</programlisting>

	<para>ÕâÀïµÄ <option>dir</option> Ñ¡Ïî¿ÉÒÔÓÃÀ´ÉèÖÃÓÃÓÚ±£´æÉó¼ÆÈÕÖ¾µÄÒ»¸ö»ò¶à¸öĿ¼¡£
	  Èç¹ûÖ¸¶¨Á˶à¸öĿ¼£¬ Ôò½«ÔÚÌîÂúÒ»¸öÖ®ºó»»ÓÃÏÂÒ»¸ö¡£ Ò»°ã¶øÑÔ£¬
	  Éó¼Æͨ³£¶¼»áÅäÖÃΪ±£´æÔÚÒ»¸öרÓõÄÎļþϵͳ֮Ï£¬
	  ÒÔ±ÜÃâÉó¼ÆϵͳÓëÆäËü×ÓϵͳÔÚÎļþϵͳÂúµÄʱºòËù²úÉúµÄ³åÍ»¡£
	  </para>

	<para><option>flags</option> ×Ö¶ÎÓÃÓÚΪÓÐÖ÷ʼþÅäÖÃϵͳ¼¶µÄԤѡÌõ¼þ¡£
	  ÔÚÇ°ÃæµÄÀý×ÓÖУ¬ ËùÓÐÓû§³É¹¦ºÍʧ°ÜµÄµÇ¼ºÍ×¢Ïú¶¼»á±»Éó¼Æ¡£</para>

	<para><option>minfree</option> ²ÎÊýÓÃÓÚ¶¨Òå±£´æÉó¼ÆÈÕÖ¾µÄÎļþϵͳÉÏÊ£Óà¿Õ¼äµÄ×îС°Ù·Ö±È¡£
	  µ±³¬¹ýÕâÒ»ãÐֵʱ£¬ ½«²úÉúÒ»¸ö¾¯¸æ¡£ Ç°ÃæµÄÀý×ÓÖУ¬ ×îСʣÓà¿Õ¼ä±ÈÀýÉèÖóÉÁËÁ½³É¡£</para>

	<para><option>naflags</option> Ñ¡Ïî±íʾÉó¼ÆÀàÉó¼ÆÎÞÖ÷ʼþ£¬
	  ÀýÈç×÷ΪµÇ¼½ø³ÌºÍϵͳ·þÎñµÄÄÇЩ½ø³ÌµÄʼþ¡£</para>

	<para><option>policy</option> Ñ¡ÏîÓÃÓÚÖ¸¶¨Ò»¸öÒÔ¶ººÅ·Ö¸ôµÄ²ßÂÔ±êÖ¾±í£¬
	  ÒÔ¿ØÖÆһϵÁÐÉó¼ÆÐÐΪ¡£ ĬÈ쵀 <literal>cnt</literal> ±êÖ¾±íʾϵͳӦÔÚÉó¼Æʧ°Üʱ¼ÌÐøÔËÐÐ
	  (Ç¿ÁÒ½¨ÒéʹÓÃÕâ¸ö±êÖ¾)¡£ ÁíÒ»¸ö³£ÓõıêÖ¾ÊÇ
	  <literal>argv</literal>£¬ Ëü±íʾÔÚÉó¼ÆÃüÁîÖ´ÐвÙ×÷ʱ£¬
	  ͬʱÉó¼Æ´«¸ø &man.execve.2; ϵͳµ÷ÓõÄÃüÁîÐвÎÊý¡£</para>

	<para><option>filesz</option> Ñ¡ÏîÖ¸Ã÷ÁËÉó¼ÆÈÕÖ¾ÔÚ×Ô¶¯Í£Ö¹¼Ç¼ºÍ·­×ªÖ®Ç°ÔÊÐíµÄ×î´ó³ß´ç¡£
	  ĬÈÏÖµ 0 ±íʾ½ûÓÃ×Ô¶¯ÈÕÖ¾·­×ª¡£ Èç¹ûÅäÖõÄÖµ²»ÊÇÁ㣬 µ«Ð¡ÓÚ×îСֵ 512k£¬
	  ÔòÕâ¸öÅäÖûᱻºöÂÔ£¬ ²¢ÔÚÈÕÖ¾ÖмǼÕâÒ»ÏûÏ¢¡£</para>
      </sect3>

      <sect3 id="audit-audituser">
	<title><filename>audit_user</filename> Îļþ</title>

	<para><filename>audit_user</filename> ÎļþÔÊÐí¹ÜÀíԱΪÌض¨Óû§Ö¸¶¨½øÒ»²½µÄÉó¼ÆÐèÇó¡£
	  ÿһÐÐʹÓÃÁ½¸ö×Ö¶ÎÀ´ÅäÖÃÓû§µÄÉó¼Æ£º
	  µÚÒ»¸öÊÇ <literal>alwaysaudit</literal> ×ֶΣ¬ ËüÖ¸Ã÷ÁËÒ»×é¶Ô¸ÃÓû§×Ü»á½øÐÐÉó¼ÆµÄʼþ£»
	  ¶øµÚ¶þ¸öÔòÊÇ <literal>neveraudit</literal> ×ֶΣ¬
	  ËüÖ¸Ã÷ÁËһϵÁжԸÃÓû§²»Éó¼ÆµÄʼþ¡£</para>

	<para>ÔÚÏÂÊö <filename>audit_user</filename> ʾÀýÎļþÖУ¬
	  Éó¼ÆÁË <username>root</username> Óû§µÄ µÇ¼/×¢Ïú ʼþ£¬ ÒÔ¼°³É¹¦µÄÃüÁîÖ´ÐÐʼþ£¬
	  ´ËÍ⣬ »¹Éó¼ÆÁË <username>www</username> Óû§µÄÎļþ´´½¨ºÍ³É¹¦µÄÃüÁîÖ´ÐÐʼþ¡£
	  Èç¹ûÓëÇ°ÃæµÄʾ·¶ <filename>audit_control</filename> ÎļþÅäºÏʹÓã¬
	  Ôò <username>root</username> µÄ <literal>lo</literal> Ïî¾ÍÊǶàÓàµÄ£¬ ¶ø¶Ô
	  <username>www</username> Óû§¶øÑÔ£¬ ÆäµÇ¼/×¢ÏúʼþÒ²»á±»Éó¼Æ£º</para>

	<programlisting>root:lo,+ex:no
www:fc,+ex:no</programlisting>

      </sect3>
    </sect2>
  </sect1>

  <sect1 id="audit-administration">
    <title>¹ÜÀíÉó¼Æ×Óϵͳ</title>

    <sect2>
      <title>²é¿´Éó¼ÆÈÕÖ¾</title>

      <para>Éó¼Æ¼ÇÕÊÊÇÒÔ BSM ¶þ½øÖƸñʽ±£´æµÄ£¬ Òò´Ë±ØÐëʹÓù¤¾ßÀ´¶ÔÆä½øÐÐÐ޸ģ¬
	»ò½«Æäת»»ÎªÎı¾¡£ &man.praudit.1;
	ÃüÁîÄܹ»½«¼ÇÕÊÎļþת»»Îª¼òµ¥µÄÎı¾¸ñʽ£» ¶ø
	&man.auditreduce.1 ÃüÁîÔò¿ÉÒÔΪ·ÖÎö¡¢ ´æµµ»ò´òÓ¡Ä¿µÄÀ´Å¨ËõÉó¼ÆÈÕÖ¾Îļþ¡£
	<command>auditreduce</command> Ö§³ÖһϵÁÐɸѡ²ÎÊý£¬ °üÀ¨Ê¼þÀàÐÍ¡¢ ʼþÀà¡¢
	Óû§¡¢ ʼþµÄÈÕÆÚºÍʱ¼ä£¬ ÒÔ¼°Îļþ·¾¶»ò²Ù×÷¶ÔÏó¡£</para>

      <para>ÀýÈ磬 <command>praudit</command> ¹¤¾ß»á½«Ö¸¶¨µÄÉó¼Æ¼ÇÕÊת´æΪ¼òµ¥Îı¾¸ñʽµÄÉó¼ÆÈÕÖ¾£º</para>

      <screen>&prompt.root; <userinput>praudit /var/audit/AUDITFILE</userinput></screen>

      <para>´Ë´¦ <filename><replaceable>AUDITFILE</replaceable></filename> ÊÇҪת´æµÄÉó¼ÆÈÕÖ¾Îļþ¡£</para>

      <para>Éó¼Æ¼ÇÕÊÖаüÀ¨Ò»ÏµÁÐÉó¼Æ¼Ç¼£¬ ÕâЩ¼Ç¼ÓÉһϵÁжÌÓï (token) ×é³É£¬
	¶ø <command>praudit</command> ÄÜ°ÑËüÃÇ˳ÐòÏÔʾΪһÐС£
	ÿ¸ö¶ÌÓﶼÊôÓÚij¸öÌض¨µÄÀàÐÍ£¬ ÀýÈç
	<literal>header</literal> ±íʾÉó¼Æ¼Ç¼ͷ£¬ ¶ø
	<literal>path</literal> Ôò±íʾÔÚÒ»´ÎÃû×Ö²éÕÒÖеÄÎļþ·¾¶¡£ ÏÂÃæÊÇÒ»¸ö
	<literal>execve</literal> ʼþµÄÀý×Ó£º</para>

      <programlisting>header,133,10,execve(2),0,Mon Sep 25 15:58:03 2006, + 384 msec
exec arg,finger,doug
path,/usr/bin/finger
attribute,555,root,wheel,90,24918,104944
subject,robert,root,wheel,root,wheel,38439,38032,42086,128.232.9.100
return,success,0
trailer,133</programlisting>

      <para>Õâ¸öÉó¼Æ¼Ç¼±íʾһ´Î³É¹¦µÄ <literal>execve</literal>
	µ÷Ó㬠ִÐÐÁË <literal>finger doug</literal>¡£ ÔÚ²ÎÊý¶ÌÓïÖÐÊÇÓÉ shell Ìá½»¸øÄں˵ÄÃüÁîÐС£
	<literal>path</literal> ¶ÌÓï°üº¬ÁËÓÉÄں˲éÕҵõ½µÄ¿ÉÖ´ÐÐÎļþ·¾¶¡£ <literal>attribute</literal> ¶ÌÓïÖаüº¬Á˶ԿÉÖ´ÐÐÎļþµÄÃèÊö£¬
	ÌرðµØ£¬ Ëü°üÀ¨ÁËÎļþµÄȨÏÞģʽ£¬ ÓÃÒÔÈ·¶¨Ó¦ÓóÌÐòÊÇ·ñÊÇ setuid µÄ¡£
	<literal>subject</literal>(Ö÷Ìå) ¶ÌÓïÃèÊöÁËÖ÷Ìå½ø³Ì£¬ ²¢Ë³Ðò¼Ç¼ÁËÉó¼ÆÓû§ ID¡¢ ÉúЧÓû§ ID ºÍ×é ID¡¢
	ʵ¼ÊÓû§ ID ºÍ×é ID¡¢ ½ø³Ì ID¡¢ »á»° ID¡¢ ¶Ë¿Ú ID£¬ ÒÔ¼°µÇ¼µØÖ·¡£
	×¢ÒâÉó¼ÆÓû§ ID ºÍʵ¼ÊÓû§ ID ÊDz»Í¬µÄ£º
	Óû§ <username>robert</username> ÔÚÖ´ÐÐÕâ¸öÃüÁî֮ǰÒѾ­Çл»Îª
	<username>root</username> ÕÊ»§£¬ µ«Ëü»áÒÔ×î³õ½øÐÐÉí·ÝÑéÖ¤µÄÓû§Éí·Ý½øÐÐÉó¼Æ¡£
	×îºó£¬ <literal>return</literal> ¶ÌÓï±íʾִÐгɹ¦£¬ 
	¶ø <literal>trailer</literal> ±íʾÖÕ½áÕâÒ»¼Ç¼¡£</para>

      <para>ÔÚ &os; 6.3 ÒÔ¼°ÒÔºóµÄ°æ±¾ÖУ¬ <command>praudit</command>
	¿ÉÒÔÑ¡ÔñʹÓà <option>-x</option> ²ÎÊýÀ´Ö§³Ö XML ¸ñʽµÄÊä³ö¡£</para>

    </sect2>

    <sect2>
      <title>ŨËõÉó¼Æ¼ÇÕÊ</title>

      <para>ÓÉÓÚÉó¼ÆÈÕÖ¾¿ÉÄÜ»áºÜ´ó£¬ ¹ÜÀíÔ±¿ÉÄÜ»áÏ£ÍûÑ¡Ôñ¼Ç¼µÄÒ»¸ö×Ó¼¯À´Ê¹Óã¬
	ÀýÈçÓëÌض¨Óû§Ïà¹ØµÄ¼Ç¼£º</para>

      <screen>&prompt.root; <userinput>auditreduce -u trhodes /var/audit/AUDITFILE | praudit</userinput></screen>

    <para>Õ⽫ѡÔñ±£´æÔÚ
	<filename><replaceable>AUDITFILE</replaceable></filename> ÖеÄËùÓÐÓÉ
      <username>trhodes</username> ²úÉúµÄÉó¼ÆÈÕÖ¾¡£</para>
    </sect2>

    <sect2>
      <title>ίÅÉÉó¼Æ¸´ÉóȨÏÞ</title>

      <para>ÔÚ <groupname>audit</groupname> ×éÖеÄÓû§£¬
	ÓµÓжÁÈ¡ <filename>/var/audit</filename> ϵÄÉó¼Æ¼ÇÕʵÄȨÏÞ£»
	ĬÈÏÇé¿öÏ£¬ Õâ¸ö×éÊǿյģ¬ Òò´ËÖ»ÓÐ <username>root</username> Óû§¿ÉÒÔ¶ÁÈ¡Éó¼Æ¼ÇÕÊ¡£
	Èç¹ûÏ£Íû¸øij¸öÓû§Ö¸¶¨Éó¼Æ¸´ÉóȨ£¬ Ôò¿ÉÒÔ½«Æä¼ÓÈë <groupname>audit</groupname>¡£
	ÓÉÓڲ鿴Éó¼ÆÈÕÖ¾µÄÄÚÈÝ¿ÉÒÔÌṩ¹ØÓÚÓû§ºÍ½ø³ÌÐÐΪµÄ´óÁ¿Éî¶ÈÐÅÏ¢£¬
	ÔÚÄúίÅÉÕâЩȨÁ¦Ê±£¬ ÇëÎñ±Ø½÷É÷ÐÐÊ¡£</para>
    </sect2>

    <sect2>
      <title>ͨ¹ýÉó¼Æ¹ÜµÀÀ´ÊµÊ±¼à¿Ø</title>

      <para>Éó¼Æ¹ÜµÀÊÇλÓÚÉ豸ÎļþϵͳÖеÄ×Ô¶¯¸´ÖÆ (cloning) µÄÐéÄâÉ豸£¬
	ÓÃÓÚÈÃÓ¦ÓóÌÐò¿ØÖÆÕýÔÚÔËÐеÄÉó¼Æ¼Ç¼Á÷£¬ ÕâÖ÷ÒªÊÇΪÁËÂú×ãÈëÇÖ¼ì²âºÍϵͳ¼à¿ØÈí¼þ×÷ÕßµÄÐèÒª¡£
	²»¹ý£¬ ¶Ô¹ÜÀíÔ±¶øÑÔ£¬ Éó¼Æ¹ÜµÀÉ豸ҲÌṩÁËÒ»ÖÖÎÞÐèðÉó¼Æ¼ÇÕÊÎļþÊôÖ÷³öÏÖÎÊÌâµÄÂé·³£¬
	»òÓÉÓÚÈÕÖ¾·­×ª¶ø´ò¶ÏʼþÁ÷µÄÂé·³£¬ ¶øʵÏÖʵʱ¼à¿ØµÄ·½±ã;¾¶¡£ Òª¸ú×ÙʵʱʼþÁ÷£¬
	ʹÓÃÏÂÃæµÄÃüÁîÐУº</para>

      <screen>&prompt.root; <userinput>praudit /dev/auditpipe</userinput></screen>

      <para>ĬÈÏÇé¿öÏ£¬ Éó¼Æ¹ÜµÀÉ豸½ÚµãÖ»ÓÐ <username>root</username> Óû§²ÅÄÜ·ÃÎÊ¡£ Èç¹ûÏ£Íû
	<groupname>audit</groupname> ×éµÄ³ÉÔ±Äܹ»·ÃÎÊËü£¬ Ó¦ÔÚ <filename>devfs.rules</filename>
	ÖмÓÈëÏÂÊö <literal>devfs</literal> ¹æÔò£º</para>

      <programlisting>add path 'auditpipe*' mode 0440 group audit</programlisting>

      <para>Çë²Î¼û &man.devfs.rules.5; ÒÔÁ˽â¹ØÓÚÅäÖà devfs ÎļþϵͳµÄ½øÒ»²½ÐÅÏ¢¡£</para>

      <warning>
	<para>ºÜÈÝÒ×ÅäÖóöÉó¼Æʼþ·´À¡Ñ­»·£¬ Ò²¾ÍÊDz鿴ʼþµÄ²Ù×÷±¾Éí»á²úÉú¸ü¶àµÄʼþ¡£
	  ÀýÈ磬 Èç¹ûËùÓеÄÍøÂç I/O ¾ù±»Éó¼Æ£¬ ÓÖÔÚ SSH »á»°ÖÐÖ´ÐÐ
	  &man.praudit.1;£¬ ¾Í»áÒԺܸߵÄËÙÂʲúÉú³ÖÐøµÄÉó¼ÆʼþÁ÷£¬
	  ÒòΪÿÏÔʾһ¸öʼþ¶¼»á²úÉúеÄʼþ¡£ ½¨ÒéÄúÔÚÐèÒªÔÚÉó¼Æ¹ÜµÀÉ豸ÉÏÖ´ÐÐ
	  <command>praudit</command> ʱ£¬ Ñ¡ÔñÒ»¸öûÓнøÐÐϸÁ£¶È
	  I/O Éó¼ÆµÄ»á»°À´ÔËÐС£</para>
      </warning>
    </sect2>

    <sect2>
      <title>Éó¼Æ¼ÇÕÊÎļþµÄÂÖת</title>

      <para>Éó¼Æ¼ÆÕËÖ»ÓÉÄÚºËдÈ룬 ÇÒÖ»ÄÜÓÉ
	<application>auditd</application> ¹ÜÀí¡£ ¹ÜÀíÔ±²»Ó¦³¢ÊÔʹÓà &man.newsyslog.conf.5;
	»òÆäËü¹¤¾ßÀ´Íê³ÉÉó¼ÆÈÕÖ¾µÄÂÖת¹¤×÷¡£ Äú¿ÉÒÔʹÓà <command>audit</command>
	¹ÜÀí¹¤¾ßÀ´¹Ø±ÕÉó¼Æ¡¢ ÖØÐÂÅäÖÃÉó¼Æϵͳ£¬ ²¢Íê³ÉÈÕÖ¾ÂÖת¡£
	ÏÂÃæµÄÃüÁÈÃÉó¼Æ·þÎñ´´½¨ÐµÄÉó¼ÆÈÕÖ¾£¬
	²¢·¢ÐźŸøÄÚºËÒªÇóÆäʹÓÃеÄÈÕÖ¾¡£ ¾ÉÈÕÖ¾½«ÖÕÖ¹²¢±»¸ÄÃû£¬
	´Ëʱ£¬ ¹ÜÀíÔ±¾Í¿ÉÒÔ²Ù×÷ËüÁË¡£</para>

      <screen>&prompt.root; <userinput>audit -n</userinput></screen>

      <warning>
	<para>Èç¹û <application>auditd</application> ·þÎñ³ÌÐòûÓÐÔÚÔËÐУ¬
	  ÔòÕâ¸öÃüÁʧ°Ü²¢¸ø³ö´íÎóÌáʾ¡£</para>
      </warning>

      <para>ÔÚ <filename>/etc/crontab</filename> ¼ÓÈëÈçÏÂÉèÖã¬
	½«Ê¹ &man.cron.8; ÿʮ¶þСʱ½«ÈÕÖ¾ÂÖתһ´Î¡£</para>

      <programlisting>0     */12       *       *       *       root    /usr/sbin/audit -n</programlisting>

      <para>ÕâЩÐ޸ĻáÔÚÄú±£´æ <filename>/etc/crontab</filename> ºóÉúЧ¡£</para>

      <para>¶ÔÓÚÉó¼Æ¼ÇÕÊÎļþ»ùÓڳߴçµÄ×Ô¶¯·­×ª£¬ ¿ÉÒÔͨ¹ý
	&man.audit.control.5; ÖÐµÄ <option>filesz</option> Ñ¡ÏîÀ´ÅäÖã¬
	Õâ¸öÑ¡ÏîÔÚÕâÒ»ÕµÄÅäÖÃÎļþÒ»½ÚÖÐÒѾ­½éÉܹý¡£</para>
    </sect2>

    <sect2>
      <title>ѹËõÉó¼Æ¼ÇÕÊ</title>

      <para>ÓÉÓÚÉó¼Æ¼ÇÕÊÎļþ»á±äµÃºÜ´ó£¬ ͨ³£»áÏ£ÍûÔÚÉó¼Æ·þÎñ¹Ø±ÕËüʱ£¬
	¶ÔÆä½øÐÐѹËõ»ò¹éµµ¡£ <filename>audit_warn</filename> ½Å±¾¿ÉÒÔÓÃÀ´ÔÚһϵÁÐÓëÉó¼ÆÓйصÄʼþ·¢Éúʱ£¬
	Ö´ÐÐһЩÓû§¶¨ÒåµÄ²Ù×÷£¬ ÕâÒ²°üÀ¨ÔÚÉó¼Æ¼ÇÕÊ·­×ªÊ±½øÐÐÇåÀí²Ù×÷¡£ ¾ÙÀý¶øÑÔ£¬ ¿ÉÒÔÔÚ
	<filename>audit_warn</filename> ½Å±¾ÖмÓÈëÏÂÁÐÄÚÈÝÀ´ÔÚÉó¼Æ¼ÇÕʹرÕʱѹËõËü£º</para>

      <programlisting>#
# Compress audit trail files on close.
#
if [ "$1" = closefile ]; then
        gzip -9 $2
fi</programlisting>

      <para>ÆäËü´æµµ²Ù×÷Ò²°üÀ¨½«Éó¼Æ¼ÇÕʸ´ÖƵ½Ò»¸öÖÐÑëµÄ·þÎñÆ÷£¬ ɾ³ý¾ÉµÄ¼ÇÕÊÎļþ£¬
	»òŨËõÉó¼Æ¼ÇÕʲ¢É¾³ý²»ÐèÒªµÄ¼Ç¼µÈ¡£ Õâ¸ö½Å±¾»áÔÚÉó¼Æ¼ÇÕÊÎļþÕý³£¹Ø±ÕʱִÐÐÒ»´Î£¬
	Òò´ËÔÚ·ÇÕý³£¹Ø±Õϵͳʱ£¬ ¾Í²»»áÖ´ÐÐËüÁË¡£</para>
    </sect2>
  </sect1>
</chapter>