diff options
Diffstat (limited to 'en_US.ISO8859-1/books/handbook/audit/chapter.sgml')
-rw-r--r-- | en_US.ISO8859-1/books/handbook/audit/chapter.sgml | 26 |
1 files changed, 13 insertions, 13 deletions
diff --git a/en_US.ISO8859-1/books/handbook/audit/chapter.sgml b/en_US.ISO8859-1/books/handbook/audit/chapter.sgml index 352487dcd3..34670e78ee 100644 --- a/en_US.ISO8859-1/books/handbook/audit/chapter.sgml +++ b/en_US.ISO8859-1/books/handbook/audit/chapter.sgml @@ -599,6 +599,19 @@ trailer,133</programlisting> </sect2> <sect2> + <title>Delegating Audit Review Rights</title> + + <para>Members of the <literal>audit</literal> group are given + permission to read audit trails in <filename>/var/audit</filename>; + by default, this group is empty, so only the root user may read + audit trails. Users may be added to the <literal>audit</literal> + group in order to delegate audit review rights to the user. As + the ability to track audit log contents provides significant insight + into the behavior of users and processes, it is recommended that the + delegation of audit review rights be performed with caution.</para> + </sect2> + + <sect2> <title>Live Monitoring Using Audit Pipes</title> <para>Audit pipes are cloning pseudo-devices in the device file system @@ -696,18 +709,5 @@ fi</programlisting> audit trail files are cleanly terminated, so will not be run on trails left unterminated following an improper shutdown.</para> </sect2> - - <sect2> - <title>Delegating Audit Review Rights</title> - - <para>Members of the <literal>audit</literal> group are given - permission to read audit trails in <filename>/var/audit</filename>; - by default, this group is empty, so only the root user may read - audit trails. Users may be added to the <literal>audit</literal> - group in order to delegate audit review rights to the user. As - the ability to track audit log contents provides significant insight - into the behavior of users and processes, it is recommended that the - delegation of audit review rights be performed with caution.</para> - </sect2> </sect1> </chapter> |