NOTE: If the primary audit log continues to grow past the FSS point, a
NOTE: If other activities consume space on the file system, or the file system chosen has insufficient space for the AFS size chosen, the File Space Switch point can be reached before the Audit File Switch point.
Choose a file system with adequate space for your audit log files. You can assess the size of your file systems using the bdf command. HP recommends you configure your log files to at least the following parameters:
•The file system must have more than 5000 KB available for the primary audit log file.
•It must have more than 20% of its total file space available.
TIP: HP recommends that the primary and auxiliary audit log files reside on separate file systems.
The growth of audit log files is closely monitored by the audit overflow monitor daemon, audomon, to insure that no audit data is lost.
Configuring Audit Log Files
Use the audsys command to specify the primary audit log file and the (optional) auxiliary audit log file to collect auditing data. For example:
#audsys
This example specifies a primary audit file 5000K in size, and an auxiliary audit file 2500K in size. Refer to audsys(1M) for more information about using the audsys command to configure audit log files.
NOTE: If you specify the name of an existing file as your auxiliary audit log file, the contents of the file will be overwritten.
CAUTION: If the file system containing the primary log file is full and no auxiliary log file is specified, any non root process that generates audit data will block inside the kernel. Also, if a non root process is connected to the system terminal, it will be terminated. For details see the WARNINGS section of the audsys(1M) manpage.
Viewing Audit Logs
Auditing accumulates a lot of data. Use the audisp command to selects the data you want to view:
#/usr/sbin/audisp audit_file
The following options are available with the audisp command:
Displays failed events only.
Displays successful events only.
Displays the selected system call.
Displays start time.
Displays end time.
Displays information for a specific user.
Displays information for a specific terminal.