IBM Support

AIX AUDIT: How can I monitor system time changes?

Question & Answer


Question

Which audit events should I enable to monitor system time and date changes?

Answer

The following events are defined in the AIX Audit System "Events" section.
User or System Call Audit Event Description
settimer PROC_Settimer Sets current value for a specified system-wide timer.
adjtime PROC_Adjtime Changes the system clock. (This is affected when clock is adjusted (date -a +- sss.fff)
The following settings are included in /etc/security/audit/config:
streammode = on
stream:
       cmds = /etc/security/audit/streamcmds
classes:
         datechange=PROC_Adjtime,PROC_Settimer
root = datechange
 
The auditpr command includes verbose information.
# cat /etc/security/audit/streamcmds
/usr/sbin/auditstream | auditpr -htpPrlceR -w > /audit/stream.out &

Example:
As root, change the date, and move clock forward 10 seconds.
# date 0420115623;date -a +10.0
Now check the /audit/stream.out log:
event           command login    real status time of day                  role         
-------------- --------- ------ ---- ------ ---------------------------- ------------------------
PROC_Settimer   date    root     root OK     20 Apr 2023 11:56:54.000000  Version not supported  
old time: 0:64411512, new time: 2e32ecb7:2ff47600

PROC_Adjtime    date     root     root  OK     20 Apr 2023 11:56:54.002236  Version not supported 
old time: 0:64410c66, delta: 45ffc4:0
SUPPORT

Security configuration involves comprehensive features. Most of these features require advanced review and planning by administrators who are familiar with all of their system requirements. AIX Support does not make specific recommendations to harden your system. Customization is out of the scope of AIX Support, but if you have specific questions about documented usage, our support experts are happy to assist.

You can learn more about the audit functionality on AIX and best practices through the following resources:
 

If you have specific questions about usage after reviewing the recommended documentation, IBM AIX Support will be happy to assist.

If you require consulting services, there are more fee-based services available.

If you require usage assistance, use the following step-by-step instructions to contact IBM to open a case for software with an active and valid support contract.  
 

1.  Document (or collect screen captures of) all symptoms, errors, and messages related to your issue.

2.  Capture any logs or data relevant to the situation.

3.  Contact IBM to open a case:

   -For electronic support, see the IBM Support Community:
     https://www.ibm.com/mysupport
   -If you require telephone support, see the web page:
      https://www.ibm.com/planetwide/

4.  Provide a clear, concise description of the issue.

 

5.  If the system is accessible, collect a system snap, and upload all of the details and data for your case.

  - For guidance, see: Working with IBM AIX Support: Collecting snap data

[{"Type":"MASTER","Line of Business":{"code":"LOB08","label":"Cognitive Systems"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SWG10","label":"AIX"},"ARM Category":[{"code":"a8m0z000000cw2BAAQ","label":"Security-\u003EAudit"}],"ARM Case Number":"","Platform":[{"code":"PF002","label":"AIX"}],"Version":"All Versions"}]

Document Information

Modified date:
25 May 2023

UID

ibm16332343

Page Feedback