Monitoring Unix Events for Security and Compliance

Authentication, Group Policy, Audit and Reporting

---

Likewise Event Log Tracks Linux and Unix Security Events

Likewise Event Log records and categorizes a variety of security and networking events, including authentication and authorization events such as failed logon attempts. With event log monitoring, security managers find help in their quest for regulatory compliance with Sarbanes-Oxley, the Payment Card Industry Data Security Standard, and other industry security standards.

The Likewise Event Log provides the following benefits for Linux, Unix, and Mac OS X computers:

• Helps demonstrate regulatory compliance
• Improves network security
• Tracks and records security events
• Lists failed logon attempts to
• Provides a wealth of information to help troubleshoot Active Directory connections for Linux, Unix, and Mac computers

Event Log Management for Unix, Linux, and Mac

The Likewise Administrative Console includes a management applications, or plug-in, called the Event Log Viewer. It stores authentication and security events in an embedded SQLite database and uses the database to display events from more than 118 Linux, Unix, and Mac platforms in a common, unified graphical format to detect and troubleshoot security problems with ease.

See more information about the Likewise Administrative Console.

Capturing Unix Authentication and Unix Authorization Events

The event log is a component of Likewise Enterprise that captures information about Unix authentication transactions, Unix authorization requests, network events, and other security events.

In general, the event log captures the following types of events:

• Daemon initializations
• Successful logins
• Failed login attempts
• The application of new group policy objects
• Offline-online transitions and other network connectivity events
• A periodic heartbeat that identifies whether the computer running the Likewise agent is active

Likewise Enterprise includes methods by which you can specify which user and group accounts have read or write access permissions to the event log. The typical methods for setting permissions are local configuration files and group policy objects administered from Active Directory.

In addition, you can filter events in the event log and you can decide which event categories to log. For example, on laptop computers, computers with a wireless connection, or other computers whose network status might be influx, you can turn off network event logging so that the event log is not flooded with network connectivity events.

Storage and Reporting of Events

The event log subsystem also provides facilities for storing, archiving, and categorizing events. Once stored, there is a Likewise graphical user interface for generating reports, including reports specifically geared toward demonstrating regulatory compliance. The result is a complete Unix system monitoring package.

See more information on the Likewise Unix authentication system and the event log subsystem.

Next > > Workgroup Manager Overview