5.5 Audit Settings

This section includes different audit options to capture additional information about the command that is executed, directory path from where the command is executed, history of commands that are executed, and so on.

To configure the audit settings, perform the following:

Click Settings > Server Settings > Audit Settings on the Administration Console.

Specify the Audit settings:

Password filter: Set this toggle to on to enable the password filter option. This prompts users for their passwords and user’s response gets encrypted in the Command Control reports.

For example, if the system requests a user’s password with the term Password, specify Password in this field. If the system uses password, specify password in this field.

You can also use regular expressions as a password filter:

=~#([Pp]assword:)|(RDN:)#

This password filter must match Password, password, or RDN.

Select the required details under Metadata Audit Settings to capture more information in the audit record:

Metadata	Description
Command	Complete information about the command that has been executed, including the actual filename and arguments.
Run Account	Details of account that is used to execute the command.
Host	Information about the submitting host
Process	Details about the process that submitted the request.
Environment	Complete list of the environment variables that are passed to the executed command.
Jobs	Details about the job control setting that were passed with the command.
Local Time	Details about the time on the machine that submitted the request.
Password	Details of the /etc/passwd entry for the user submitting the request.
Cwd	Details about the current working directory where the command was executed.
Groups	Details about the group membership for the executed command.
Options	Details about the various process control options for executing the command.
Logon	Login time and source for the user submitting the request.
History	History of executed commands.

Click Update.