|
The Question is:
When performing the SHOW AUDIT command I get a the message that system security
audits are enabled for
Audit: Illformed
Please explain the implications of this for me
Thanks
The Answer is :
Nefarious users have been known to try all kinds of tactics in an attempt
to confound and confuse auditing systems in order to cover their tracks.
These include sending bogus auditing messages or requests to the security
system, hoping to find a fatal error which crashes the audit server
process and thereby preventing further auditing. The "ILLFORMED" class of
audit enables reporting of any incomplete or syntactically incorrect audit
or security request.
Should an illformed message be reported, it means that you're either under
attack from someone trying to break the security system, or there is a
coding error in code attempting to communicate with the security system.
Please report any instances of this alarm being triggered to your local
Customer Support Centre.
|
