HP UX 11i Role-based Access Control (RBAC) Software Audit Log Files, Self-auditing processes

processes are programmed to suspend auditing of the actions they invoke and produce one audit log entry describing the process that occurred. Processes programmed in this way are called self-auditing programs; using self-auditing programs streamlines audit log data.

You can turn off self-auditing programs by turning off auditing on the system.

NOTE: The list of self-auditing processes varies from system to system.

Self-auditing processes

The following processes have self-auditing capabilities:

chfn	Change finger entry
chsh	Change login shell
login	The login utility
newgrp	Change effective group
passwd	Change password
audevent	Select events to be audited
audisp	Display the audit data
audsys	Start or halt the auditing system
audusr	Select users to be audited
init	Change run levels, users logging off
lpsched	Schedule line printer requests
fbackup	Flexible file backup
ftpd	File transfer protocol daemon
remshd	Remote shell server daemon
rlogind	Remote login server daemon
telnetd	Telnet server daemon

Most self-auditing programs generate audit data under a single event category. For example, the audsys command generate the audit data under the admin event. Some commands generate audit data under multiple event categories. For example, the init command generates data under the login and admin events.

Audit Log Files

All auditing data is written to an audit log file. The primary log file is where audit records are collected. When this file approaches a predefined capacity (its Audit File Switch (AFS) size), or when the file system on which it resides approaches a predefined capacity (its File Space Switch (FSS) size), the auditing subsystem issues a warning. When either the AFS or the FSS of the primary log file is reached, the auditing subsystem attempts to switch to the auxiliary log file for recording audit data. If no auxiliary log file is specified, the primary log file continues to grow.

Auditing 79