IEEE ICC 2015 - Communication and Information Systems Security Symposium 1 Linux Auditing: Overhead and Adaptation Lei Zeng, Yang Xiao* Hui Chen Department of Computer Science, Department of Mathematics and The University of Alabama, Computer Science, Tuscaloosa, AL 35487-0290 USA Virginia State University, Email:
[email protected] Petersburg, VA 23806 USA *Prof. Yang Xiao is the corresponding author Abstract— Logging is a critical component of Linux auditing. The Common Criteria is closely related to the Orange Book. The experiments indicate that the logging overhead can be Its goal is to establish a guideline for developing and significant. The paper aims to leverage the performance evaluating computer products in regards to its security overhead introduced by Linux audit framework under various features. The Common Criteria concentrates on the security usage patterns. The study on the problem leads an adaptive audit logging mechanism. The adaptive auditing mechanism reduces threads from human activities. It reiterates the audit the overall system overhead and achieves a similar level of requirement for secure computer systems. Logging is essential protection on the system and network security. to meet the requirement. Although these standards recognize the importance of auditing, the focus is obviously placed in Index items: logging, overhead, Linux, auditing; bookkeeping audit trail/log, which is in fact the system activity log. In regard to the logging functionality of computer systems, I. INTRODUCTION audit information must be recorded and protected selectively UDITING in operating systems (OSs) is necessary to [1, 2, 3, 4]. It is the logging functionality that keeps and A achieve network and system security.