Files Reference

bincmds File

Purpose

Contains the shell commands that process audit bin data.

The /etc/security/audit/bincmds file is an ASCII template file that contains the backend commands that process audit binfile records. The path name of this file is defined in the bin stanza of the /etc/security/audit/config file.

This file contains command lines each composed of one or more commands with input and output that can be piped together or redirected. Although the commands usually are one or more of the audit system commands (the auditcat command, the auditpr command, the auditselect command), this is not a requirement.

As each bin file is filled by the kernel, the auditbin daemon invokes each command to process the bin records, substituting the names of the current bin file and the audit trail file for any $trail and $bin strings in the commands. Upon startup, if the auditbin daemon detects that the bin files require a recovery procedure, the command will prepend a -r to the bin file's name in $bin.

Note: The commands are executed by the trusted shell (TSH) when on the trusted path. This means that the path names in the commands must be absolute, and that environment variable substitution may be limited. See the discussion of the tsh command for more information.

Security

Access Control: This file should grant read (r) access to the root user and members of the audit group and grant write (w) access only to the root user.

Examples

To compress audit bin records and append them to the system audit trail file, include the following line in the /etc/security/audit/bincmds file:
```
/usr/sbin/auditcat -p -o $trail $bin
```
When the command runs, the names of the current bin file and the system audit-trail file are substituted for the $bin and $trail strings. Records are compressed and appended to the /audit/trail file.
To select the audit events from each bin file that are unsuccessful because of authentication or privilege reasons and append the events to the /audit/trail.violations file, you must include the following line in the /etc/security/audit/bincmds file:
```
/usr/sbin/auditselect -e "result == FAIL_AUTH || \
result == FAIL_PRIV" $bin >> /audit/trail.violations
```
To create a hard-copy audit log of all local user authentication audit events, include the following line in the /etc/security/audit/bincmds file:
```
/usr/sbin/auditselect -e "event == USER_Login || \
event == USER_SU" $bin | \
/usr/sbin/auditpr -t2 -v >/dev/lpr3 
```
Adjust the printer name to fit your requirements.

Implementation Specifics

This file is part of Base Operating System (BOS) Runtime.

Files

/etc/security/audit/bincmds	Specifies the path to the file.
/etc/security/audit/config	Contains audit-system configuration information.
/etc/security/audit/events	Contains the audit events of the system.
/etc/security/audit/objects	Contains audit events for audited objects (files).
/etc/security/audit/streamcmds	Contains auditstream commands.

Related Information

The audit command, auditcat command, auditpr command, auditselect command, tsh command.

The auditbin daemon.

Setting Up Auditing in AIX 5L Version 5.1 System Management Guide: Operating System and Devices.

Security Administration, Auditing Overview in AIX 5L Version 5.1 System Management Concepts: Operating System and Devices.