User audit trails can usually log:
– All commands directly initiated by the user;
– All identification and authentication attempts; and
– Files and resources accessed.
It is most useful if options and parameters are also recorded from commands. It is much more useful to know that a user tried to delete a log file (e.g., to hide unauthorized actions) than to know the user merely issued the delete command, possibly for a personal data file.
Leave a Reply
You must be logged in to post a comment.