Previous Topic: Trusted ProgramsNext Topic: Review the Audit Log


Monitor Use of Unregistered Programs

If you are not sure whether you have successfully registered all the appropriate programs in the database, use the following command to watch for unregistered programs:

chres PROGRAM _default warning

The warning property puts the PROGRAM class into Warning mode, meaning that a special audit record appears as a warning each time an unregistered setuid or setgid program is used but the use of such programs is not prevented.