audit ctm_menu

davidtuti · Post by **davidtuti** » 24 Jun 2010 10:15

Hi,

I would like to know if there is some way to audit when the people do a ctm_menu in controlm-server

Many thanks and sorry for my english!

hipikll · Post by **hipikll** » 25 Jun 2010 3:39

most siple way on unix (similar in windows):

$cd ~ctmsrv/ctm_server/exe_AIX
$mv ctm_menu ctm_menu1
$vi ctm_menu
(add this code like)

Code: Select all

#!/bin/sh

echo "-------" >> ctm_menu.aud
date >> ctm_menu.aud
id >> ctm_menu.aud
who >> ctm_menu.aud

ctm_menu1

$chmod 700 ctm_menu

davidtuti · Post by **davidtuti** » 26 Jun 2010 8:30

Many thanks but I use windows.

hipikll · Post by **hipikll** » 26 Jun 2010 9:47

I'm not windows scripter, but i would test something like:

find, where is ctm_menu.exe file.
rename it to ctm_menu1.exe

Then create bat file ctm_menu.bat located at the same place as original ctm_menu.exe with code like:
(sorry for wrong syntax if it is wrong)

Code: Select all

@echo off
echo "-------------" >> c:/ctm_menu.aud
echo %username% >> c:/ctm_menu.aud
date /T >> c:/ctm_menu.aud
time /T >> c:/ctm_menu.aud
ctm_menu1.exe

I think, that from my previous ansver it will be easy to make the windows equivalent.
if it is windows - try to look in Windows EventLog.

Be creative!

philmalmaison · Post by **philmalmaison** » 29 Jun 2010 10:54

not very interessant
tersync02-cm64p01 [35] id
uid=2006(cm64p01) gid=101(controlm)
tersync02-cm64p01 [36] who
cm64p01 pts/2 Jun 29 08:49 (ctmtest2)
tersync02-cm64p01 [37] date
Tuesday, June 29, 2010 10:51:03 AM MEST
tersync02-cm64p01 [38]
as you now by default, only the controlm user can use ctm_menu

hipikll · Post by **hipikll** » 29 Jun 2010 11:14

it should be good to grep who command for actual user.

yes, only ctmserver user would use ctm_menu, but, I would like to know, who is logged as ctmserver user. So,

Code: Select all

who | grep `whoami`

would gimme such info.
and command 'id' we can remove.

I know, that it is not beautiful.

I dont use it myself, it is just a idea, everyone has to modify it

.