Download Oracle® Linux - Security Guide for Release 6

Configuring and Using Process Accounting
where logsvr is the domain name or IP address of the log server and port is the port number (usually,
514).
On the log server, add the following entry to the MODULES section of /etc/rsyslog.conf:
$ModLoad imtcp
$InputTCPServerRun port
where port corresponds to the port number that you set on the log clients.
To manage the rotation and archival of the correct logs, edit /etc/logrotate.d/syslog so that it
references each of the log files that are defined in the RULES section of /etc/rsyslog.conf. You can
configure how often the logs are rotated and how many past copies of the logs are archived by editing /
etc/logrotate.conf.
It is recommended that you configure Logwatch on your log server to monitor the logs for suspicious
messages, and disable Logwatch on log clients. However, if you do use Logwatch, disable high precision
timestamps by adding the following entry to the GLOBAL DIRECTIVES section of /etc/rsyslog.conf
on each system:
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
For more information, see the logrotate(8), logwatch(8), rsyslogd(8) and rsyslog.conf(5)
manual pages, the HTML documentation in the /usr/share/doc/rsyslog-5.8.10 directory, and the
documentation at http://www.rsyslog.com/doc/manual.html.
3.10 Configuring and Using Process Accounting
The psacct package implements the process accounting service in addition to the following utilities that
you can use to monitor process activities:
ac
Displays connection times in hours for a user as recorded in the wtmp file (by default, /var/
log/wtmp).
accton
Turns on process accounting to the specified file. If you do not specify a file name argument,
process accounting is stopped. The default system accounting file is /var/account/pacct.
lastcomm
Displays information about previously executed commands as recorded in the system
accounting file.
sa
Summarizes information about previously executed commands as recorded in the system
accounting file.
Note
As for any logging activity, ensure that the file system has enough space to
store the system accounting and wtmp files. Monitor the size of the files and, if
necessary, truncate them.
For more information, see the ac(1), accton(8), lastcomm(1), and sa(8) manual pages.
3.11 Configuring and Using Software Management
Oracle Linux provides the yum utility which you can use to install or upgrade RPM packages. The main
benefit of using yum is that it also installs or upgrades any package dependencies. yum downloads
packages from repositories such as those that are available on the Oracle public yum server and the
37