Solution Summary: ACS Support for Unix and Linux Systems

[System-Center-Team]

First published on TECHNET on May 10, 2009
Available by 2nd half of 2009 (late fall) - brought to you by the System Center Cross Platform team .

Provide Audit Collection Services (ACS) for Unix and Linux systems

1. Leverage OpsMgr 2007 R2 Cross Platform infrastructure to enable Unix/Linux auditing
2. Collect and aggregate audit events across enterprise systems for a singular view
3. Out of the box support for base OS audit events

Reporting – base OS auditing reports

1. Access violations - unsuccessful logon attempts
2. Account management - Account creation/deletion/password change
3. User logons
4. Administrator activity - su, sudo
5. Forensic – all events for a computer/event ID

Management Pack (to collect events)

1. Out of the box MP for each platform
2. Datasources - Syslog, su log, audit, etc.
3. Audit event collection:
1. Logons – success/failure (Ssh, telnet, rsh, tty, ftp)
2. Privilege use activity – su, sudo
3. Account activity – create/delete/password change

Platforms

1. RedHat Enterprise 4, 5
2. Novell SLES 9, 10
3. Solaris 9, 10
4. HPUX 11iv2, 11iv3
5. AIX 5.3, 6.1

Provide the infrastructure to extend enterprise auditing - potentially for things like:

1. Network devices (e.g. Firewalls, Routers, Load balancers)
2. Applications (e.g. Databases, ERP/CRM systems)
3. Leveraging standard System Center Cross Platform logfile provider (or build your own customer provider) to read events

Delivery

1. Out of band, dependent on OpsMgr 2007 R2
2. CY Q2 2010