Veritas-bu

Re: [Veritas-bu] who has deleted or de-activated a policy?

2008-02-13 02:10:00
Subject: Re: [Veritas-bu] who has deleted or de-activated a policy?
From: "WEAVER, Simon \(external\)" <simon.weaver AT astrium.eads DOT net>
To: <Rusty.Major AT sungard DOT com>, <veritas-bu AT mailman.eng.auburn DOT edu>
Date: Wed, 13 Feb 2008 06:55:21 -0000
That in combination with the date/modified "should" at least help :-)
Simon 

-----Original Message-----
From: veritas-bu-bounces AT mailman.eng.auburn DOT edu
[mailto:veritas-bu-bounces AT mailman.eng.auburn DOT edu] On Behalf Of
Rusty.Major AT sungard DOT com
Sent: Tuesday, February 12, 2008 8:46 PM
To: veritas-bu AT mailman.eng.auburn DOT edu
Subject: Re: [Veritas-bu] who has deleted or de-activated a policy?


While this isn't perfect, it is usually pretty accurate: check the
timestamp of the policy directory to see when it was last modified and
then compare that to last to see who logged in around that time. It
doesn't always work and won't work if users log in as root, but as I
said, it tends to work for us.



If you're windows, Simon's suggestion should also work.



-Rusty



________________________________



From: veritas-bu-bounces AT mailman.eng.auburn DOT edu
[mailto:veritas-bu-bounces AT mailman.eng.auburn DOT edu] On Behalf Of "Ed
Wilts"
<ewilts AT ewilts DOT org>

Sent: Tuesday, February 12, 2008 11:09 AM

To: "Tanveer Ahmed" <ahmed.tanveer AT ubl.com DOT pk>

Cc: veritas-bu AT mailman.eng.auburn DOT edu

Subject: Re: [Veritas-bu] who has deleted or de-activated a policy?





On Feb 11, 2008 11:09 PM, Tanveer Ahmed <ahmed.tanveer AT ubl.com DOT pk>
wrote:





      Is there a any way to determine who has deleted or de-activated a
policy?





Technically, no.  And since the people making policy changes typically
also have administrative rights to the systems, it won't be foolproof
anyway (unless you send these logs off to a secure syslog server
somewhere).





We have a text file containing our own changelog.  If we catch somebody
not updating the changelog when he's made a change, we let him have it.
Peer pressure works fairly well.



   ..../Ed





--

Ed Wilts, Mounds View, MN, USA

mailto:ewilts AT ewilts DOT org _______________________________________________

Veritas-bu maillist - Veritas-bu AT mailman.eng.auburn DOT edu

http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu




_______________________________________________
Veritas-bu maillist  -  Veritas-bu AT mailman.eng.auburn DOT edu
http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu

This email (including any attachments) may contain confidential and/or
privileged information or information otherwise protected from disclosure.
If you are not the intended recipient, please notify the sender
immediately, do not copy this message or any attachments and do not use it
for any purpose or disclose its content to any person, but delete this
message and any attachments from your system. Astrium disclaims any and all
liability if this email transmission was virus corrupted, altered or
falsified.
---------------------------------------------------------------------
Astrium Limited, Registered in England and Wales No. 2449259
REGISTERED OFFICE:-
Gunnels Wood Road, Stevenage, Hertfordshire, SG1 2AS, England

_______________________________________________
Veritas-bu maillist  -  Veritas-bu AT mailman.eng.auburn DOT edu
http://mailman.eng.auburn.edu/mailman/listinfo/veritas-bu

<Prev in Thread] Current Thread [Next in Thread>