Script not working


We are trying to use sample "Log Originating Host in Auditing" but this
is not getting logged in HPUX

  • I'm assuming you are meaning 'Log Originating Host IP Address in
    Auditing' sample rule included in within PUM.

    I did a very simple rule to test:

    Begin Rule: test
    If ((command IN pcksh))
    Then
    Set Authorize: yes
    Set Session Capture: yes
    Run Script: Log Originating Host IP Adress in Auditing()
    Stop if authorized
    End If
    End Rule: test


    I tested this on the following hosts and they worked just fine for me:

    SLES 11SP2 64bit
    AIX 5.3
    RedHat 5.6 6bit
    HPUX 11.11

    Each time, I went into the GUI | Reporting and under the host column, it
    showed me the host as well as the IP/DNS name of the originiating host.

    I'd start by looking in the unifid.log on the agent to see if there are
    any errors related to the script. Next I would look in the Command
    Control Manager unifid.log for errors.

    - Brett


    --
    deni
    ------------------------------------------------------------------------
    deni's Profile: https://forums.netiq.com/member.php?userid=1793
    View this thread: https://forums.netiq.com/showthread.php?t=44963