[SAGE] Re: sage-members-digest V2 #1617

[Andrew Hume <andrew@research.att.com>]

regarding sudosh, SOx, and syslog,

	there seems to be a wide range of opinion on what SOx is.
while i am neither a lawyer nor an accountant, and i certainly do not
speak for AT&T, my work in this area leads to observe a couple of 
points:

1) satisfying SOx for nearly all people is like doing ISO 9000;
all you have to do is that when you produce a (financial) result,
you should have a documented plausible procedure for doing so,
and some proof that that procedure was followed.
it seems clear to me that sudosh and syslog would satisfy that UNLESS
syslog in your installation was especially error-prone.

2) the more stringent methods alluded to by other comments seem
to me to be aimed at more exacting requirements, akin to those
testifying in court. and no, syslog will not cut it for that situation.

----
Andrew Hume  (best -> Telework) +1 732-886-1886
andrew@research.att.com  (Work) +1 973-360-8651
AT&T Labs - Research; member of USENIX and SAGE