150.5. Basic Security Module Auditing (im_bsm)

Table of Contents

This module provides support for parsing events logged using Sun’s Basic Security Module (BSM) Auditing API. This module reads directly from the kernel. See also xm_bsm.

Note	To examine the supported platforms, see the list of installer packages in the Available Modules chapter.

The BSM /dev/auditpipe device file is available on FreeBSD and macOS. On Solaris, the device file is not available and the log files must be read and parsed with im_file and xm_bsm as shown in the example.

150.5.1. Setup

For information about setting up BSM Auditing, see the xm_bsm Setup section.

150.5.2. Configuration

The im_bsm module accepts the following directives in addition to the common module directives.

DeviceFile: This optional directive specifies the device file from which to read BSM events. If this is not specified, it defaults to /dev/auditpipe.

EventFile: This optional directive can be used to specify the path to the audit event database containing a mapping between event names and numeric identifiers. The default location is /etc/security/audit_event which is used when the directive is not specified.

150.5.3. Fields

See the xm_bsm Fields.

150.5.4. Examples

Example 846. Reading BSM audit events from the kernel

This configuration reads BSM audit events directly from the kernel via the (default) /dev/auditpipe device file (which is not available on Solaris, see the xm_bsm example instead).

nxlog.conf

1
2
3
4

  <Input in>
    Module      im_bsm
    DeviceFile  /dev/auditpipe
</Input>

You are here

150.5. Basic Security Module Auditing (im_bsm) | Log Collection Solutions

NXLog User Guide