Manual page for AUDIT_CONTROL(5)
audit_control - control information for system audit daemon
file contains audit control information read by
Each line consists of a title and a string, separated by a colon.
There are no restrictions on the order of lines in the file,
although some lines must appear only once.
A line beginning with
is a comment.
Directory definition lines list the directories to be used
when creating audit files, in the order in which they are to be used.
The format of a directory line is:
is the name of a directory in which to create audit files,
with the form:
is the name of an audit file system on the machine
where this audit directory resides, and
is the name of the local machine,
since audit files belonging to different machines are, by convention,
stored in separate subdirectories of a single audit directory.
The naming convention normally has
be the name of a server machine, and all clients mount
at the same location in their local file systems.
If the same server exports several different file systems for auditing, their
names will, of course, be different.
The audit threshold line specifies the percentage of free space
that must be present in the file system containing the current audit file.
The format of the threshold line is:
is indicates the amount of free space required.
If free space falls below this threshold, the audit daemon
invokes the shell script
If no threshold is specified, the default is 0%.
The audit flags line specifies the default system audit value.
This value is combined with the user audit value read from
to form the process audit state. The user audit value overrides
the system audit value.
The format of a flags line is:
specifies which event classes are to be audited.
The character string representation of
contains a series of flag
names, each one identifying a single audit class, separated by commas.
A name preceded by
means that the class should be audited for failure only;
successful attempts are not audited.
A name preceded by
means that the class should be audited for success only;
failing attempts are not audited.
Without a prefix, the name indicates that the class is to be audited
for both successes and failures.
The special string
indicates that all events should be audited;
indicates that all failed attempts are to be audited, and
all successful attempts.
flags specified earlier in the string
for failing and successful attempts,
They are typically used to reset flags.
The following table lists the audit classes:
short name long name short description
dr data_read Read of data, open for reading, etc.
dw data_write Write or modification of data
dc data_create Creation or deletion of any object
da data_access_change Change in object access (modes, owner)
lo login_logout Login, logout, creation by .Hr -url ../html1/at.1.html at(1)
ad administrative Normal administrative operation
p0 minor_privilege Privileged operation
p1 major_privilege Unusual privileged operation
Here is a sample
file for the machine eggplant:
This identifies server
with two file systems normally used for audit data, another server
used only when
fills up or breaks,
and specifies that the warning script is run
when the file systems are 80% filled.
It also specifies that all logins, privileged and administrative operations
are to be audited (whether or not they succeed),
and that failures of all types except failures to access data
are to be audited.
# Last-ditch audit file system when jedgar fills up.
Created by unroff & hp-tools.
© by Hans-Peter Bischof. All Rights Reserved (1997).
Last modified 21/April/97