From owner-freebsd-questions@FreeBSD.ORG Mon Oct 20 09:38:18 2014 Return-Path: Delivered-To: freebsd-questions@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 906C9C1B for ; Mon, 20 Oct 2014 09:38:18 +0000 (UTC) Received: from eu1sys200aog117.obsmtp.com (eu1sys200aog117.obsmtp.com [207.126.144.143]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by mx1.freebsd.org (Postfix) with ESMTPS id E079085F for ; Mon, 20 Oct 2014 09:38:17 +0000 (UTC) Received: from mail-wi0-f171.google.com ([209.85.212.171]) (using TLSv1) by eu1sys200aob117.postini.com ([207.126.147.11]) with SMTP ID DSNKVETX8yDtG0HO4O95Jl+QIMK2716RlUD5@postini.com; Mon, 20 Oct 2014 09:38:17 UTC Received: by mail-wi0-f171.google.com with SMTP id em10so6540800wid.16 for ; Mon, 20 Oct 2014 02:37:55 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:date:from:message-id:to:subject:reply-to; bh=m9GCb9ar1B+Dn5YFm/VWGAq/Z2pRU41UqI5GIY+tn3k=; b=ivT855+OTPehWjLA4L1h4NTseHUt6C2LppBhdm259Ldw0PpKnKvB3puzmGiANduywg VHa5rxdUjJt8dMHtd3Dib5R4Eq9GsphURFIUjzDxs2ug+rvSEQU9UmsSk29ylE8pUc8x qEeVddj2RrJogVqj/PxhllT5diwHwhUOttQSnqmt6w4+HZjojIzKX13T+78SoA600DBc LjGejKaXDcLBNBfHYMaYiFK4H1YLfKDkuMU4lml5Ultj9VSYqzQpsEgqAd10CydNkXvu l5ASBpYTX4lG5ibe6qUpGnlUlXo33wsDKNhSRGjj1/UDwv3JnpUSN3VUiJstyXFr0fVx 6afQ== X-Received: by 10.194.110.10 with SMTP id hw10mr31803263wjb.102.1413797874937; Mon, 20 Oct 2014 02:37:54 -0700 (PDT) X-Gm-Message-State: ALoCoQl1rbLn0/7JEblLWJ10+OUF6kTDtaAPvlXlqfuaUjxtoSM45MtyzD58fCR61DHaHDipGgBD6Lx3Tyym1hKdK+t3GUWl2gu3PbGgr8E5kZEJfxV2TPjPy5viAcjED3QmIAs0DqezV/fDHeJBQhEsvN04g8nNjCgOvKiAt8niDCgF5zhWLos= X-Received: by 10.194.110.10 with SMTP id hw10mr31803225wjb.102.1413797874561; Mon, 20 Oct 2014 02:37:54 -0700 (PDT) Received: from mech-as221.men.bris.ac.uk (mech-as221.men.bris.ac.uk. [137.222.187.221]) by mx.google.com with ESMTPSA id u8sm11245898wjq.1.2014.10.20.02.37.53 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Mon, 20 Oct 2014 02:37:53 -0700 (PDT) Received: from mech-as221.men.bris.ac.uk (localhost [127.0.0.1]) by mech-as221.men.bris.ac.uk (8.14.9/8.14.9) with ESMTP id s9K9bqJp019399 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Mon, 20 Oct 2014 10:37:52 +0100 (BST) (envelope-from mexas@mech-as221.men.bris.ac.uk) Received: (from mexas@localhost) by mech-as221.men.bris.ac.uk (8.14.9/8.14.9/Submit) id s9K9bqk3019398 for freebsd-questions@freebsd.org; Mon, 20 Oct 2014 10:37:52 +0100 (BST) (envelope-from mexas) Date: Mon, 20 Oct 2014 10:37:52 +0100 (BST) From: Anton Shterenlikht Message-Id: <201410200937.s9K9bqk3019398@mech-as221.men.bris.ac.uk> To: freebsd-questions@freebsd.org Subject: system identification in utx database? Reply-To: mexas@bris.ac.uk X-BeenThere: freebsd-questions@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: User questions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 20 Oct 2014 09:38:18 -0000 Hello Is there any information in a utx(8) database (log) that allows one to identify the system where that database was recorded? I cannot find any. I need to preserve the utx access logs from several FreeBSD boxes. If I copy the logs to another box, or just print, I lose the information about the system where these logs came from. This is because this information does not seem to be present in the logs themselves. So I have to add some manual database identification, which might cast doubt on the database authenticity or integrity, if I even need to rely such databases, e.g. in court. So, I wonder if there is some system identification information written to utx database that I'm not familiar with. I also have auditing enabled, but I'm still learning it, and don't want to loose the simplicity of utx. Shall I ask in securuty@ list? Thanks Anton