system identification in utx database?
Anton Shterenlikht
mexas at bris.ac.uk
Mon Oct 20 09:38:18 UTC 2014
Hello
Is there any information in a utx(8) database (log)
that allows one to identify the system where
that database was recorded? I cannot find any.
I need to preserve the utx access logs from several
FreeBSD boxes. If I copy the logs to another box,
or just print, I lose the information about the
system where these logs came from.
This is because this information does not
seem to be present in the logs themselves.
So I have to add some manual database identification,
which might cast doubt on the database authenticity
or integrity, if I even need to rely such databases,
e.g. in court.
So, I wonder if there is some system identification
information written to utx database that I'm not
familiar with.
I also have auditing enabled, but I'm still
learning it, and don't want to loose the
simplicity of utx.
Shall I ask in securuty@ list?
Thanks
Anton
More information about the freebsd-questions
mailing list