Basic Audit Reporting Tool (Overview)
BART is a file tracking tool that operates entirely at the file
system level. Using BART gives you the ability to quickly, easily, and reliably
gather information about the components of the software stack that is installed on deployed
systems. Using BART can greatly reduce the costs of administering a network of
systems by simplifying time-consuming administrative tasks.
BART enables you to determine what file-level changes have occurred on a system,
relative to a known baseline. You use BART to create a baseline or
control manifest from a fully installed and configured system. You can then compare
this baseline with a snapshot of the system at a later time, generating
a report that lists file-level changes that have occurred on the system since
it was installed.
The bart command is a standard UNIX command. You can redirect the
output of the bart command to a file for later processing.
BART Features
BART has been designed with an emphasis on a simple syntax that
is both powerful and flexible. The tool enables you to generate manifests of
a given system over time. Then, when the system's files need to be
validated, you can generate a report by comparing the old and new manifests.
Another way to use BART is to generate manifests of several similar systems
and run system-to-system comparisons. The main difference between BART and existing auditing tools is
that BART is flexible, both in terms of what information is tracked
and what information is reported.
Additional benefits and uses of BART include the following:
Provides an efficient and easy method for cataloging a system that is running the Solaris software at the file level.
Enables you to define which files to monitor and gives you the ability to modify profiles when necessary. This flexibility allows you to monitor local customizations and enables you to reconfigure software easily and efficiently.
Ensures that systems are running reliable software.
Allows you to monitor file-level changes of a system over time, which can help you locate corrupted or unusual files.
Helps you troubleshoot system performance issues.
BART Components
BART has two main components and one optional component:
BART Manifest
BART Report
BART Rules File
BART Manifest
You use the bart create command to take a file-level snapshot of a system
at a particular time. The output is a catalog of files and file
attributes called a manifest. The manifest lists information about all the files or
specific files on a system. It contains information about attributes of files, which
can include some uniquely identifying information, such as an MD5 checksum. For more
information about the MD5 checksum, see the md5(3EXT) man page. A manifest can be
stored and transferred between client and server systems.
Note - BART does not cross file system boundaries, with the exception of file systems
of the same type. This constraint makes the output of the bart create command
more predictable. For example, without arguments, the bart create command catalogs all UFS file systems
under the root (/) directory. However, no NFS or TMPFS file systems or
mounted CD-ROMs would be cataloged. When creating a manifest, do not attempt to
audit file systems on a network. Note that using BART to monitor networked
file systems can consume large resources to generate manifests that will have little
value.
For more information about BART manifests, see BART Manifest File Format.
BART Report
The report tool has three inputs: the two manifests to be compared
and an optional user-provided rules file that indicates which discrepancies are to be flagged.
You use the bart compare command to compare two manifests, a control manifest and a
test manifest. These manifests must be prepared with the same file systems, options, and
rules file that you use with the bart create command.
The output of the bart compare command is a report that lists per-file discrepancies
between the two manifests. A discrepancy is a change to any attribute
for a given file that is cataloged for both manifests. Additions or deletions
of file entries between the two manifests are also considered discrepancies.
There are two levels of control when reporting discrepancies:
These levels of control are intentional, since generating a manifest is more costly
than reporting discrepancies between two manifests. Once you have created manifests, you have
the ability to compare manifests from different perspectives by running the bart compare command
with different rules files.
For more information about BART reports, see BART Reporting.
BART Rules File
The rules file is a text file that you can optionally use as input
to the bart command. This file uses inclusion and exclusion rules. A rules
file is used to create custom manifests and reports. A rules file enables
you to express in a concise syntax which sets of files you want
to catalog, as well as which attributes to monitor for any given set
of files. When you compare manifests, the rules file aids in flagging discrepancies
between the manifests. Using a rules file is an effective way to gather
specific information about files on a system.
You create a rules file by using a text editor. With a
rules file, you can perform the following tasks:
Use the bart create command to create a manifest that lists information about all or specific files on a system.
Use the bart compare command to generate a report that monitors specific attributes of a file system.
Note - You can create several rules files for different purposes. However, if you create
a manifest by using a rules file, you must use the same
rules file when you compare the manifests. If you do not use the
same rules file when comparing manifests that were created with a rules file,
the output of the bart compare command will list many invalid discrepancies.
A rules file can also contain syntax errors and other ambiguous information as
a result of user error. If a rules file does contain misinformation, these
errors will also be reported.
Using a rules file to monitor specific files and file attributes on a
system requires planning. Before you create a rules file, decide which files and
file attributes on the system you want to monitor. Depending on what
you are trying to accomplish, you might use a rules file to create
manifests, compare manifests, or for purposes.
For more information about the BART rules file, see BART Rules File Format and the
bart_rules(4) man page.
