RE: Prerequisites for Installing RealSecure System Agent

Subject: RE: Prerequisites for Installing RealSecure System Agent
From: Droski, Sheila (ISSTexas) (SDroskiiss.net)
Date: Fri Dec 03 1999 - 18:06:16 CST

• Next message: Eirik: "Re: Multiple Security Engineers Sharing Internet Scanner"
• Previous message: Brian Laing: "RE: Multiple Security Engineers Sharing Internet Scanner"
• Maybe in reply to: Brian Tan Wee Beng: "Prerequisites for Installing RealSecure System Agent"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
majordomoiss.net Contact issforum-owneriss.net for help with any problems!
----------------------------------------------------------------------------

Hi Brian,
The only real requirements are:
- Any system running Solaris SPARC 2.5.1, 2.6, 2.7
- The system agent typically uses 5 MB RAM and less than 1% of the CPU

You'll also just want to be sure the system isn't short on hard drive space
for BSM logs to accumulate. The system agent is pretty smart about this and
periodically consolidates and cleans up the logging done for
RealSecure...you know how unhappy Unix gets if it runs short on disk space!
The information below is from one of our developers on how RealSecure system
agent reduces the log files:

"RealSecure System Agent limits the size of the currently-active BSM log
file to 20MB. It does this by internally monitoring the log file's size
and, when this limit is reached, it starts a new log file.

Then, RSSA takes the newly-archived file and auditreduces it to remove all
RSSA-only entries leaving only those entries that were caused by auditing
that was enabled *outside* of RealSecure. Thus, if no other BSM auditing is
taking place, these archived files will be very small in size (24 bytes)
consisting of two file linkage records.

RealSecure does not do any further management of the archived files and it
is up to the system administrator to decide the
disposition of those files. E.g. if no other auditing is being done, I
recommend a cron job to remove all the terminated files. If other auditing
is being done, then the administrator should already have a management
policy in place for the archived files and that should continue to work
after RSSA installation."

hope this helps,
sheila

-----Original Message-----
From: Brian Tan Wee Beng [mailto:tanwbbhotmail.com]
Sent: Wednesday, December 01, 1999 6:53 AM
To: issforumiss.net
Subject: Prerequisites for Installing RealSecure System Agent

TO UNSUBSCRIBE: email "unsubscribe issforum" in the body of your message to
majordomoiss.net Contact issforum-owneriss.net for help with any
problems!
----------------------------------------------------------------------------

Hi
  Does anyone knows what are the prerequisites for installing a RealSecure
System Agent on a Sun Solaris 2.5.1 machine??

Cheers

______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com

• Next message: Eirik: "Re: Multiple Security Engineers Sharing Internet Scanner"
• Previous message: Brian Laing: "RE: Multiple Security Engineers Sharing Internet Scanner"
• Maybe in reply to: Brian Tan Wee Beng: "Prerequisites for Installing RealSecure System Agent"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

This archive was generated by hypermail 2b27 : Mon Dec 06 1999 - 23:38:35 CST