At present, auditing of our commercial Banks is in a mixed transitional period from transaction-based auditing to system-based auditing and risk-based auditing.

The first tools for meeting these requirements are system auditing and host-based intrusion detection.

This article focuses specifically on the practical aspects of periodic system auditing based on real-world requirements from a system administrator of a subnet in a large academic network.