Auditing Sessions

This chapter describes how to install and use the IBM Security Administration and Services components. The auditing service is a process on each managed UNIX and Linux computer that captures user session input and output and transfers this information to a collector service. The collector service forwards the audited sessions to a database, where it is available for review and replay.

• Install Auditing Components on Windows
• Configure a New Audit Installation
• Enabling Linux Desktop Auditing
• Check that Auditing is Enabled
• Viewing Sessions with Predefined Queries
• Replaying a Session
• Managing Audited Sessions
• Creating Custom Queries