Safeguard for Sudo 7.0 - Administration Guide

Syntax

pmloadcheck -v 
               -s|-p|-i [-e <interval>][-t <sec>] 
               [-c|-f][-b][ -h <master>][-t <sec>] [-a][-r]

Description

The pmloadcheck daemon runs on Safeguard for Sudo policy servers. By default, every 60 minutes the daemon verifies the status of the configured policy servers. It controls load balancing and failover for connections made from the host to the configured policy servers, and on secondary servers, it sends license data to the primary server.

When the pmloadcheck daemon runs, it attempts to establish a connection with the policy servers to determine their current status. If pmloadcheck successfully establishes a session with a policy server, it is marked as online and is made available for normal client sessions. If pmloadcheck does not successfully establish a session with a policy server, it is marked as offline.

Information is gathered from a policy server each time a normal client session connects to the policy server. This information is used to determine which policy server to use the next time a session is requested. If an agent cannot establish a connection to a policy server because, for example, the policy server is offline, then this policy server is marked as offline and no more connections are submitted to this policy server until it is marked available again.

To check the current status of all configured policy servers, and display a brief summary of their status, run pmloadcheck with no options. Add the –f option to show full details of each policy server status.

Options

pmloadcheck has the following options.

Table 19: Options: pmloadcheck
Option	Description
-a	Verifies the connection as if certificates were configured.
-b	Runs in batch mode.
-c	Displays output in CSV format.
-e <interval>	Sets the refresh interval (in minutes) to determine how often the pmloadcheck daemon checks the policy server status. Default = 60.
-f	Shows full details of the policy server status when verifying and displaying policy server status.
-h <master>	Selects a policy server to verify.
-i	Starts up the pmloadcheck daemon, or prompt an immediate recheck of the policy server status if it is already running.
-P	Sends SIGNUP to a running daemon.
-p	Pauses (sends SIGUSR1) to a running daemon.
-r	Reports last cached data for selected servers instead of connecting to each one.
-s	Stops the pmloadcheck daemon if it is running.
-t <sec>	Specifies a timeout (in seconds) to use for each connection.
-v	Displays the version string and exits.

pmlog

Syntax

pmlog [-dlvq] [-p|a|e|r|x <printexpr>] [-f <filename>] [[-c] <constraint>] 
         [[-c] <constraint>] [-f <filename>] -h 
         [--user <username>] 
         [--runuser <username>] [--runhost <hostname>] [--reqhost <hostname>]  
         [--masterhost <hostname>][--command <pattern>] [--reqcommand <pattern>]  
         [--runcommand <pattern>][--before "<YYYY/MM/DD hh:mm:ss>"]  
         [--after "<YYYY/MM/DD hh:mm:ss>"][--result Accept|Reject]

Description

Use the pmlog command to selectively choose and display entries in a Privilege Manager for Sudo event log. Each time a job is accepted, rejected, or completed by pmmasterd, an entry is appended to the file specified by the eventlog variable in the configuration file. eventlog is sent to /var/opt/quest/qpm4u/pmevents.db on all platforms.

Options

pmlog has the following options.

Table 20: Options: pmlog
Option	Description
-a <expression>	Sets the print expression for accept events to the specified expression.
-c <constraint>	Selects particular entries to print; specify constraint as a Boolean expression. See Examples.
-d	Dumps each entry as it is read without matching 'accept' and 'end' entries. The -d (dump) option forces pmlog to print each entry as it is read from the file. The default output format includes a unique identifier at the start of each record, allowing 'end' events to be matched with 'accept' events.
-e <expression>	Sets the print expression for finish events to the specified expression.
-f <filename>	Reads the event log information from the specified file.
-h	Displays usage information.
-l	Dumps alert log entries only.
-p <expression>	Sets the print expression for all event types to the specified expression.
-q	Runs in quiet mode; no expression errors (for example, undefined variables) are printed.
-r <expression>	Sets the print expression for reject events to the specified expression.
-v	Turns on verbose mode.
-x <expression>	Sets the print expression for alert events to the specified expression.
Quick Search Options
--user <username>	Selects entries in which the requesting user matches username.
--runuser <username>	Selects entries in which runuser matches username.
--runhost <hostname>	Selects entries in which runhost matches hostname.
--reqhost <hostname>	Selects entries in which the requesting host matches hostname.
--masterhost <hostname>	Selects entries in which masterhost matches hostname.
--command <pattern>	Selects entries in which the requested command matches pattern.
--reqcommand <pattern>	Return events where the given text appears anywhere in the requested command line.
--runcommand <pattern>	Selects entries in which the runcommand host matches pattern.
--before "<YYYY/MM/DD hh:mm:ss>"	Selects entries occurring before the specified date and time.
--after "<YYYY/MM/DD hh:mm:ss>"	Selects entries occurring after the specified date and time.
--result Accept\|Reject	Selects entries that were accepted or rejected.

Examples

Without arguments, pmlog reads the default eventlog file and prints all its entries. If you have chosen a different location for the event log, use the -f option to specify the file for pmlog.

By default, pmlog displays one entry for each completed session (either rejected or accepted). You can filter the results to print only entries which satisfy the specified constraint using the -c option. In these examples the -c option is used to specify a constraint as a Boolean expression:

pmlog -c'event=="Reject"'

pmlog -c'date > "2008/02/11"'

pmlog -c'user=="dan"'

which prints only rejected entries, entries that occur after February 11, 2008, or requests by user Dan, respectively.

See Safeguard Variables for more information about policy variables.

The following options accept shortcut notations to specify constraints:

--user username
--runuser username
--reqhost hostname
--runhost hostname
--masterhost hostname
--command command
--runcommand command
--reqcommand command
--before "YYYY/MM/DD hh:mm:ss"
--after "YYYY/MM/DD hh:mm:ss"
--result Accept|Reject

For example, here are equivalent constraints to the previous example specified using shortcuts:

pmlog --result Reject

pmlog --after "2008/02/11 00:00:00"

pmlog --user dan

With shortcuts, you can express user names and host names as patterns containing wild card characters (? and *). For example, to display entries for all requests for user1, user2, and user3, use the following shortcut:

pmlog --user “user?"

Enclose patterns containing wild card characters in quotes to avoid being interpreted by the command shell.

Use the -d and -v options for debugging. Normally, when pmlog finds an 'accept' entry, it refrains from printing until the matching 'end' entry is found; all requested information including exitstatus, exitdate, and exittime is then available to print.

The -d (dump) option forces pmlog to print each entry as it is read from the file. The default output format includes a unique identifier at the start of each record, allowing 'end' events to be matched with 'accept' events.

The -v (verbose) option prints all the variables stored with each entry.

The -t option turns on tail follow mode. The program enters an endless loop, sleeping and printing new event records as they are appended to the end of the log file. The -d flag is implied when using -t.

You can specify the output format for each of the three event types - 'accept', 'reject' or 'finish' - with the -a, -r, and -e options. Use the -p option to set the output for all three event types.

For example, to print only the dates and names of people making requests, enter:

pmlog -p'date + "\t" + user + "\t" + event'

-OR-

pmlog -p 'sprintf("%s %-8s %s", date, user, event)'

See Listing event logs for more examples of using the pmlog command.

Note that if you run pmlog --csv console to obtain CSV output from pmlog, refer to pmlogsearch for a list of the column headings.

pmlogadm

Syntax

pmlogadmin> archive <event_log_path> <archive_path> --before <YYYY-MM-DD> 
           [--clean-source] [--dest-dir <destination_path>] [--no-zip]
pmlogadmin> archive <event_log_path> <archive_path> --older-than <days> 
           [--clean-source] [--dest-dir <destination_path>] [--no-zip]
pmlogadmin> backup <event_log_path> <backup_path>
pmlogadmin> create <new_event_log_path>
pmlogadmin> encrypt enable|disable|rekey <event_log_path>
pmlogadmin> help [<command>]
pmlogadmin> import [-y|-n] <source_event_log> <dest_event_log>
pmlogadmin> info <event_log_path>
pmlogadmin> --help|-h
pmlogadmin> --version|-v

Description

Privilege Manager event log administration utility. Use pmlogadm to manage encryption options on the event log.

Options

pmlogadm has the following options.

Table 21: Options: pmlogadm
Option	Description
-h, --help	Displays usage information. help [<command>] By default the help command displays the general usage output. When you specify a command, it displays a usage summary for that command.
-v, --version	Displays the version number of Safeguard and exits.

Table 22: Global options: pmlogadm
Option	Description
--verbose	Enables verbose output.
--silent	Disables all output to stdout. Errors are output to stderr.

Table 23: Valid commands: pmlogadm
Option	Description
archive	Moves old events to an archive. archive <event_log_path> <archive_name> --before <YYYY-MM-DD> [--cleansource] [--dest-dir <destination_path>] [--no-zip] -OR- archive <event_log_path> <archive_name> --older-than <days> [--cleansource] [--dest-dir <destination_path>] [--no-zip] Moves events that occurred before the indicated date (YYYY-MM-DD) to an archive-named archive_name. If you use the second form, specify the date as days before the current date. The archive is created in the current working directory unless you specify a destination path using the --dest-dir option. By default, the archive is compressed using tar and gzip, but you can skip this using the --no-zip option, in which case the resulting archive is a directory containing the new log with the archived events. All files in that directory are required to access the archive. To access the archive, use pmlog. Moving events to an archive may not reduce the actual file size of the event log. To reduce the file size, the source log must be cleaned. To clean the source log, add the --clean-source option. When a large number of events are present in the source log this option can increase the archive process time and use a large amount of disk space while the process runs. Once started, do not interrupt the process.
backup	Creates a backup of the source log (event_log_path), in location backup_log.
create	Creates new empty audit files for that log. create <new_event_log_path> This may include a keyfile which has the -kf suffix, a journal file with the -wal suffix, and a -shm system file. It is critical that the group of files that make up an event log remain together at all times. Removal of any one of these files may result in permanent loss of access to the event log.
encrypt	Enables or disables encryption of an event log. encrypt enable\|disable\|rekey <event_log_path> By default all event logs created by Safeguard are encrypted using the AES-256 standard. The encryption key is stored in the keyfile which is in the same path as the event log and has the same file name, and the -kf suffix. It is critical that this file remain in the same path as the main event log file. You can decrypt the whole log file using the encrypt disable command, passing the path of the main event log file as an argument. Enable encryption using encrypt enable. The encrypt rekey command generates a new encryption key and re-encrypt all data in the event log using that new key data. The key file is automatically updated with the new key data if the operation succeeds.
import	Imports events. import [-y\|-n] <source_event_log> <dest_event_log> Import events from source_event_log, adding them to dest_event_log.
info	Displays information about the event log. info <event_log_path> Displays information about the event_log_path. The information reported includes the current encryption status of the event log, the size of the file and the number of events contained in the log.

Settings

The following entries in the /etc/opt/quest/qpm4u/pm.settings file are used by pmlogadm

Table 24: Settings: pmlogadm
Option	Description
Specify the location of the event log queue, used by both pmmasterd and pmlogsrvd. This option is only used to determine whether the pmlogsrvd service is currently running.

For more usage information for a specific command, run:

pmlogadm help <command>

Files

The default Privilege Manager event log file is located at:

/var/opt/quest/qpm4u/pmevents.db

Other files that may be used by pmlogadm are:

settings file: /etc/opt/quest/qpm4u/pm.settings
pid file: /var/opt/quest/qpm4u/evcache/pmlogsrvd.pid

Syntax

pmlogsearch [--csv] [--no-sort] 
               [--before "<YYYY/MM/DD hh:mm:ss>"] [--after "<YYYY/MM/DD hh:mm:ss>"] 
               [--user <username>] [--host <hostname>] [--result accept|reject] 
               [--text <keyword>]
               -h | --help  
               -v | --version

Description

Use the pmlogsearch command to perform a search on all logs in this policy group based on specified criteria.

You must specify at least one search condition; you can combine conditions.

Options

pmlogsearch has the following options.

Table 25: Options: pmlogsearch
Option	Description
--csv	Outputs the search results in CSV format, suitable for consumption by Safeguard. If this option is not present, the output is human-readable. One or more of the search criteria must be present, and any combination of the criteria is accepted. When multiple criteria are present they must all be matched (that is, the query criteria are combined using AND logic) for a log to be included in the results.
--after --before	Returns logs generated for sessions initiated after or before the specified time and date. For example: # pmlogsearch --after “2012/01/04 00:00:00” returns all logs for sessions since January 4, 2012. # pmlogsearch --after “2012/01/01 00:00:00” --before “2012/12/31 23:59” returns all logs generated during 2012.
--user <username>	Searches for logs generated by sessions requested by the specified user name. username is case sensitive. For example: # pmlogsearch --user harry returns the locations of all keystrokelogs for sessions requested by the user named "harry". The pattern may include the following wild card symbols: * = match any string ? = match any single character
--host <hostname>	Searches for logs generated by sessions that ran on hosts matching the given pattern. The pattern may include the following wild card symbols: * = match any string ? = match any single character For example: # pmlogsearch --host “myhost?.mydomain.com” matches logs for sessions that ran on myhost1.mydomain.com or myhost2.mydomain.com, but not myhost1 or myhost10.mydomain.com. # pmlogsearch --host “myhost*” matches logs for sessions that ran on myhost1.mydomain.com, myhost2.mydomain.com, myhost1 or myhost10.mydomain.com, but will not match anotherhost.mydomain.com. # pmlogsearch --host myhost11.mydomain.com only matches logs for sessions that ran on host myhost11.mydomain.com.
--result	Returns only events with the indicated result.
--text “<keyword>”	Searches for events where the specified text occurs in the command line or events with keystroke logs that contain the specified text. You must enter the keyword or phrase as one argument. If the phrase contains a space, enclose the whole phrase in quotes. For example: # pmlogsearch --text “my phrase” matches any log containing the string "my phrase". # pmlogsearch --text phone matches logs containing any word with the substring phone (such as, telephone, headphones, phones), or the complete word phone.
--no-sort	Does not sort the results.
–v \| --version	Displays the version number of Safeguard and exits.
-h \| --help	Displays usage information and exits.

Output

You can output the search results in either human-readable or CSV format.

Human-Readable Output

The following is an example of the human-readable output of a search:

# pmlogsearch --user sheldon --text Linux 
Search matches 5 events 
2012/01/19 18:12:25 : Accept : sheldon@host1.example.com 
   Request: sheldon@host1.example.com : uname -a 
Executed: root@host1.example.com : uname -a 
   IO Log: pmsrv1.example.com: opt/quest/qpm4u/iologs/sheldon/root/uname-20120119-181225.OiaiBr 
2012/01/19 18:11:56 : Accept : sheldon@host1.example.com 
   Request: sheldon@host1.example.com : uname -a 
Executed: root@host1.example.com : uname -a 
   IO Log: pmsrv2.example.com: opt/quest/qpm4u/iologs/sheldon/root/uname-20120119-181156.x46qJP 
2012/01/19 17:59:09 : Accept : sheldon@host2.example.com 
   Request: sheldon@host2.example.com : uname -a 
Executed: root@host2.example.com : uname -a 
   IO Log: pmsrv2.example.com: opt/quest/qpm4u/iologs/sheldon/root/uname-20120119-175909.1H0P5n 
2012/01/19 17:58:42 : Accept : sheldon@host2.example.com 
   Request: sheldon@host2.example.com : uname -a 
Executed: root@host2.example.com : uname -a 
   IO Log: pmsrv2.example.com: opt/quest/qpm4u/iologs/sheldon/root/uname-20120119-175842.ZvfrMv 
2012/01/19 17:58:14 : Accept : sheldon@host2.example.com 
   Request: sheldon@host2.example.com : uname -a 
Executed: root@host2.example.com : uname -a 
   IO Log: pmsrv1.example.com: opt/quest/qpm4u/iologs/sheldon/root/uname-20120119-175814.

CVS output

The results are output in CSV format, without field headings. The columns are listed in order below:

Session date/time
Session Unique ID
Master host
Submit host (host from which the session was requested)
Submit user (the user that requested the session)
Requested host
Requested user account
Requested command line
Result (Accept/Reject)
Run host (the host on which the command was run)
Run user (the user account used to run the command)
Command line that ran
The exit return code if the command ran successfully, or "NO_EXIT" if the event was rejected or the command failed to run
Keystroke log host. This column is blank, if it is the same as #3 Master host.
Keystroke log file path

The following is an example of CSV output:

# pmlogsearch --csv --user penny --text "Linux" 
"2012/01/19 18:10:40", "4d3729207eec", "pmsrv1.example.com", "host1.example.com", "penny", "uname", "Accept", "host1.example.com", "penny", "uname", "pmsrv1.example.com", "opt/quest/qpm4u/iologs/host1.example.com/penny/uname-20120119-181040.hLqZFY" 
"2012/01/19 18:10:13", "4d3729057e5f", "pmsrv1.example.com", "host1.example.com", "penny", "uname", "Accept", "host1.example.com", "penny", "uname", "pmsrv1.example.com", "opt/quest/qpm4u/iologs/host1.example.com/penny/uname-20120119-181013.yG1m41" 
"2012/01/19 18:00:14", "4d3726ae1ec0", "pmsrv2.example.com", "host1.example.com", "penny", "uname", "Accept", "host1.example.com", "penny", "uname", "pmsrv2.example.com", "opt/quest/qpm4u/iologs/host1.example.com/penny/uname-20120119-180015.Z42heZ" 
"2012/01/19 18:00:47", "4d3726cf1f9d", "pmsrv1.example.com", "host1.example.com", "penny", "uname", "Accept", "host1.example.com", "penny", "uname", "pmsrv1.example.com", "opt/quest/qpm4u/iologs/host1.example.com/penny/uname-20120119-180047.GUtrRt"

Safeguard for Sudo 7.0 - Administration Guide

pmloadcheck

Syntax

Description

Options

pmlog

Syntax

Description

Options

Examples

pmlogadm

Syntax

Description

Options

Settings

Files

Related Topics

pmlogsearch

Syntax

Description

Options

Output

CVS output

Related Topics

Please select your product:

To serve you better, please complete the Purpose of your Chat:

Recommended Solutions for Your Problem

Safeguard for Sudo 7.0 - Administration Guide

pmloadcheck

Syntax

Description

Options

pmlog

Syntax

Description

Options

Examples

pmlogadm

Syntax

Description

Options

Settings

Files

Related Topics

pmlogsearch

Syntax

Description

Options

Output

CVS output

Related Topics