Security Audit filters configuration

[Former Member]

Hi,

Can any one help me with Security Audit filters configuration?

I want to know what are the variuos Static and Dynamic Profile paramaters to be set as part of Security Audit Filter Setting.

If possible pls provide me with the Setup Procedure as well.

Thanks

[Former Member]

Hi Rahul,

The Static Filters are as follows:

Rsau/enable = the enables security Audit Log

Rsau/local/file = defines names and location of audit files

Rsau/max_diskspace/local = defines maximum space to allocate for audit files.

Rsau/selection_slots = defines number of filters to allow for security audit log

The Dyaamic Filters are as follows:

Rsau/local/file

Rsau/max_diskspace/local

Rasu/selection_slots

Thq

[Former Member]

Hi,

The Static Filters:

Rsau/enable = security Audit Log

Rsau/local/file = names and location of audit files

Rsau/max_diskspace/local = maximum space to allocate for audit files.

Rsau/selection_slots = number of filters to allow for security audit log

The Dynamic Filters:

Rsau/local/file

Rsau/max_diskspace/local

Rasu/selection_slots

The Static Filters:

1.Got to security Audit Log Config screen.(tools-admin-monitor-seecurity-auditlog-config)

2.Enter the name of the profile to maintain in the dip profile field

3.If you are creating new audit profile then choose profile-create else if making changes to existing then choose profile-change

4.Define filters

5.Activate the filters

6.save the data

7.Activate the profile as well

8.Restart the app server.

The Dynamic Filters:

1.Got to security Audit Log Config screen.(tools-admin-monitor-seecurity-auditlog-config)

2.Choose Dynamic config tab

3.Choose configuration – change

4.Define filters

5.Activate the filters (Configuration- Activate Audit) (Deactivate filter : Deactivate audit)

6Choose Configuration – Distribute Configuration

7.Select the status indicator in “list of active instances” table

To Define Filter: (rasu/selction_slots)

1.Select the tab for the filter you want to define

2.Enter the client and user names in the fields

3.Select the corresponding audit classes for the events you want to audit(Audit events: Critical, Important and Critical)

SM20 = to view Security Audit Logs

*Pls don't forget to avoid points if usefull.

Thanks