bsmpseu allows you to pseudonymize records from audit trail files. Personal data such as user IDs is replaced with pseudonyms, so that the generated output doesn't reveal private information about the system's users, but still preserves a maximum of integrity and consistency. bsmpseu has been designed with efficiency and privacy in mind.
bsmpseu sequentially reads one or more input audit trail files and writes the pseudonymized audit trail to standard output. The input and output audit trail files can be in plain BSM audit or in zlib(3) / gzip(1) compressed format. bsmpseu pseudonymizes a 200MB audit trail file on a plain Sun Ultra 10 in 50 seconds and pseudonymizes and compresses the same file within 8 minutes.
Depending on the type of information, the personal data is replaced by random data, cleared/blanked or shifted by a random value. Details are listed below.
Pseudonymize pathnames that match one of the prefixes from the colon-separated list. Trailing slashes are not appended to the prefixes. [Default: /export/home/:/home/:/var/mail/:/tmp/:/var/tmp/]
-D
Don't pseudonymize pathnames.
-u min:max
Pseudonymize user IDs using random values from the integer interval [ min to max ]. Default: 200 to 60000 uid.
-U
Don't pseudonymize user IDs.
-g min:max
Pseudonymize group IDs using random values from the integer interval [ min to max ]. Default: 10 to 60000 gid.
-G
Don't pseudonymize group IDs.
-p min:max
Pseudonymize process IDs using random values from the integer interval [ min to max ]. Default: 500 to 65535 pid.
-P
Don't pseudonymize process IDs.
-s shift
Pseudonymize timestamps of audit records by shifting upto a maximum of seconds. [Default: 604800 seconds]
-S
Don't pseudonymize timestamps of audit records.
-A
Don't pseudonymize internet (IPv4 and IPv6) addresses.
-E
Don't pseudonymize execution arguments and execution environment.
-z
Compress output stream using zlib(3) compress functions. This options slows down the pseudonymizing process.
-v
Display verbose information during pseudonymizing to standard error output.
-V
Display version information to standard error output.
-h
Display a help screen to standard error output.
This will pseudonymize the content of the specified audit files using the default options and display the pseudonymized audit records in human-readable form:
% bsmpseu /export/audit/* | praudit
bsmpseu is able to generate compressed output using the -z options, but it is also able to read compressed input audit trail files, as shown in the example below.
% bsmpseu /export/audit/friday.bsm.gz > /tmp/audit.bsm
Often it is not useful to pseudonymize all data types in an audit trail file. The example below shows the use of the bsmpseu tool where the process IDs and internet addresses are not pseudonymized.
% bsmpseu -P -A /var/audit/audit.bsm
> /tmp/audit.bsm