The HP-UX AUDOMON_ARGS attribute must be explicitly initialized.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-4290	GEN000000-HPUX0040	SV-38429r2_rule	ECAR-1 ECAR-2 ECAR-3	Medium

Description
The minimal set of auditing requirements necessary to collect useful forensics data and provide user help when violations are detected must be configured.

STIG	Date
HP-UX SMSE Security Technical Implementation Guide	2014-02-28

Details

Check Text ( C-36226r2_chk )
Check the /etc/rc.config.d/auditing file AUDOMON_ARGS settings: # cat /etc/rc.config.d/auditing \| tr “\011” “ “ \| tr -s “ “ \| sed -e 's/^[ \t]*//' grep -v “#” The above command should return a single line with the following information: AUDOMON_ARGS=“-p 20, -t 1, -w 90” If “p”, “t”, or “w” flags are not set to “20”, “1”, and “90”, respectively, this is a finding.

Check Text ( C-36226r2_chk )

Check the /etc/rc.config.d/auditing file AUDOMON_ARGS settings:

# cat /etc/rc.config.d/auditing | tr “\011” “ “ | tr -s “ “ | sed -e 's/^[ \t]*//' grep -v “#”

The above command should return a single line with the following information:

AUDOMON_ARGS=“-p 20, -t 1, -w 90”

If “p”, “t”, or “w” flags are not set to “20”, “1”, and “90”, respectively, this is a finding.

Fix Text (F-31485r2_fix)
Edit the /etc/rc.config.d/auditing file and insert the following line: AUDOMON_ARGS=“-p 20, -t 1, -w 90” Restart auditing: # /sbin/init.d/auditing stop # /sbin/init.d/auditing start