Audit Logs
Example audit log:
CGP2601I: [SecFS, 0] [AUDIT] Policy[allowAllOps_fs] User[root,uid=0,gid=0\root,bin,daemon,sys,adm,disk,wheel\] Process[/bin/cat] Action[write_app] Res[/opt/apps/apps1/doc/file2.txt] Key[aes128] Effect[PERMIT Code (1U,2U,3R,4M)]
Analyzing Audit log entries
The format of a File System Audit log entry is:
CGP2602I: [SecFS, 0] Level: Policy[policyName?] User[userID?] Process[command?] Access[whatIsItDoing?] Res[whatIsItDoingItTo?] Effect[allowOrDeny? Code (whatMatched?)]
| Parameter | Description |
|---|---|
| Identifier | The TLA for the error message. |
| SECFS | Indicates that the message was generated by an Agent. You can enter secfs in the Search Message field in the Logs window to display the Agent policy evaluation and GuardPoint activity for all configured hosts. |
| Level | Indicates the importance of the message. For example, AUDIT indicates an informational message, whereas ALARM indicates a critical failure that you should not ignore. |
| Policy | Indicates the name of the policy that is being used to evaluate the access attempt. |
| User | Identifies the system user attempting to access data in the GuardPoint. It typically displays the user name, user ID, and group ID. |
| Process | Indicates the command, script, or utility being executed. |
| Access | Indicates what access is being attempted. Access may be read_dir, remove_file, write_file_attr, write_app, create_file, etc. These correspond to the Access methods that you configure in the policy. Read_dir corresponds to d_rd. Remove_file corresponds to f_rm, etc. |
| Res | Indicates the object/resource being accessed by the Process[]. |
| Effect | Indicates the rule that matched and, based upon that rule, whether or not theCipherTrust Manager grants access. Access states may be either PERMIT or DENIED. |
File System Audit Log Effects Codes
Codes are provided in the audit logs that identify actions by the policy enforcement engine. The code follows the number of the rule being processed.
| Code | Definition |
|---|---|
| A | The Action component of a security rule failed to match. |
| M | All security rule components match and, unless overridden, the Effect for that security rule is applied. |
| P | The Process component of a security rule failed to match. |
| R | The Resource component of a security rule failed to match. |
| T | The time specified in the When component of a security rule failed to match. |
| U | The User component of a security rule failed to match. |
Refer to the audit log example above:
-
The first and second Security Rules fail because of a mismatch in the User component (1U, 2U).
-
The third Security Rule fails because of a Resource component (3R) mismatch.
-
All of the rules in the fourth Security Rule match (4M), and the actions defined in the policy, such as use an encryption key, are applied.
