| blob | 44b76ea86281e784b472c28505539b0d1650847a |
1 '\" te
2 .\" Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved
3 .\" Copyright 2015, Joyent, Inc. All Rights Reserved
4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
5 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
6 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
7 .TH AUDITCONFIG 1M "Jan 28, 2015"
8 .SH NAME
9 auditconfig \- configure auditing
10 .SH SYNOPSIS
11 .LP
12 .nf
13 \fBauditconfig\fR \fIoption\fR...
14 .fi
16 .SH DESCRIPTION
17 .LP
18 \fBauditconfig\fR provides a command line interface to get and set kernel audit
19 parameters.
20 .sp
21 .LP
22 This functionality is available only if the Solaris Auditing feature has been
23 enabled. See \fBbsmconv\fR(1M) for more information.
24 .sp
25 .LP
26 The setting of the \fBperzone\fR policy determines the scope of the audit
27 setting controlled by \fBauditconfig\fR. If \fBperzone\fR is set, then the
28 values reflect the local zone except as noted. Otherwise, the settings are for
29 the entire system. Any restriction based on the \fBperzone\fR setting is noted
30 for each option to which it applies.
31 .sp
32 .LP
33 A non-global zone administrator can set all audit policy options except
34 \fBperzone\fR and \fBahlt\fR. \fBperzone\fR and \fBahlt\fR apply only to the
35 global zone; setting these policies requires the privileges of a global zone
36 administrator. \fBperzone\fR and \fBahlt\fR are described under the
37 \fB-setpolicy\fR option, below.
38 .SH OPTIONS
39 .ne 2
40 .na
41 \fB\fB-aconf\fR\fR
42 .ad
43 .sp .6
44 .RS 4n
45 Set the non-attributable audit mask from the \fBaudit_control\fR(4) file. For
46 example:
47 .sp
48 .in +2
49 .nf
50 # auditconfig -aconf
51 Configured non-attributable events.
52 .fi
53 .in -2
54 .sp
56 .RE
58 .sp
59 .ne 2
60 .na
61 \fB\fB-audit\fR \fIevent\fR \fIsorf\fR \fIretval\fR \fIstring\fR\fR
62 .ad
63 .sp .6
64 .RS 4n
65 This command constructs an audit record for audit event \fIevent\fR using the
66 process's audit characteristics containing a text token \fIstring\fR. The
67 return token is constructed from the \fIsorf\fR (success/failure flag) and the
68 \fIretval\fR (return value). The event is type \fBchar*\fR, the \fIsorf\fR is
69 0/1 for success/failure, \fIretval\fR is an errno value, \fIstring\fR is type
70 \fB*char\fR. This command is useful for constructing an audit record with a
71 shell script. An example of this option:
72 .sp
73 .in +2
74 .nf
75 # auditconfig -audit AUE_ftpd 0 0 "test string"
76 #
78 audit record from audit trail:
79 header,76,2,ftp access,,Fri Dec 08 08:44:02 2000, + 669 msec
80 subject,abc,root,other,root,other,104449,102336,235 197121 elbow
81 text,test string
82 return,success,0
83 .fi
84 .in -2
85 .sp
87 .RE
89 .sp
90 .ne 2
91 .na
92 \fB\fB-chkaconf\fR\fR
93 .ad
94 .sp .6
95 .RS 4n
96 Checks the configuration of the non-attributable events set in the kernel
97 against the entries in \fBaudit_control\fR(4). If the runtime class mask of a
98 kernel audit event does not match the configured class mask, a mismatch is
99 reported.
100 .RE
102 .sp
103 .ne 2
104 .na
105 \fB\fB-chkconf\fR\fR
106 .ad
107 .sp .6
108 .RS 4n
109 Check the configuration of kernel audit event to class mappings. If the runtime
110 class mask of a kernel audit event does not match the configured class mask, a
111 mismatch is reported.
112 .RE
114 .sp
115 .ne 2
116 .na
117 \fB\fB-conf\fR\fR
118 .ad
119 .sp .6
120 .RS 4n
121 Configure kernel audit event to class mappings. Runtime class mappings are
122 changed to match those in the audit event to class database file.
123 .RE
125 .sp
126 .ne 2
127 .na
128 \fB\fB-getasid\fR\fR
129 .ad
130 .sp .6
131 .RS 4n
132 Prints the audit session ID of the current process. For example:
133 .sp
134 .in +2
135 .nf
136 # auditconfig -getasid
137 audit session id = 102336
138 .fi
139 .in -2
140 .sp
142 .RE
144 .sp
145 .ne 2
146 .na
147 \fB\fB-getaudit\fR\fR
148 .ad
149 .sp .6
150 .RS 4n
151 Returns the audit characteristics of the current process.
152 .sp
153 .in +2
154 .nf
155 # auditconfig -getaudit
156 audit id = abc(666)
157 process preselection mask = lo(0x1000,0x1000)
158 terminal id (maj,min,host) = 235,197121,elbow(172.146.89.77)
159 audit session id = 102336
160 .fi
161 .in -2
162 .sp
164 .RE
166 .sp
167 .ne 2
168 .na
169 \fB\fB-getauid\fR\fR
170 .ad
171 .sp .6
172 .RS 4n
173 Prints the audit ID of the current process. For example:
174 .sp
175 .in +2
176 .nf
177 # auditconfig -getauid
178 audit id = abc(666)
179 .fi
180 .in -2
181 .sp
183 .RE
185 .sp
186 .ne 2
187 .na
188 \fB\fB-getcar\fR\fR
189 .ad
190 .sp .6
191 .RS 4n
192 Prints current active root location (anchored from root [or local zone root] at
193 system boot). For example:
194 .sp
195 .in +2
196 .nf
197 # auditconfig -getcar
198 current active root = /
199 .fi
200 .in -2
201 .sp
203 .RE
205 .sp
206 .ne 2
207 .na
208 \fB\fB-getclass\fR \fIevent\fR\fR
209 .ad
210 .sp .6
211 .RS 4n
212 Display the preselection mask associated with the specified kernel audit event.
213 \fIevent\fR is the kernel event number or event name.
214 .RE
216 .sp
217 .ne 2
218 .na
219 \fB\fB-getcond\fR\fR
220 .ad
221 .sp .6
222 .RS 4n
223 Display the kernel audit condition. The condition displayed is the literal
224 string \fBauditing\fR meaning auditing is enabled and turned on (the kernel
225 audit module is constructing and queuing audit records); \fBnoaudit\fR, meaning
226 auditing is enabled but turned off (the kernel audit module is not constructing
227 and queuing audit records); \fBdisabled\fR, meaning that the audit module has
228 not been enabled; or \fBnospace\fR, meaning there is no space for saving audit
229 records. See \fBauditon\fR(2) and \fBauditd\fR(1M) for further information.
230 .RE
232 .sp
233 .ne 2
234 .na
235 \fB\fB-getcwd\fR\fR
236 .ad
237 .sp .6
238 .RS 4n
239 Prints current working directory (anchored from zone root at system boot). For
240 example:
241 .sp
242 .in +2
243 .nf
244 # cd /usr/tmp
245 # auditconfig -getcwd
246 current working directory = /var/tmp
247 .fi
248 .in -2
249 .sp
250 .RE
252 .sp
253 .ne 2
254 .na
255 \fB\fB-getestate\fR \fIevent\fR\fR
256 .ad
257 .sp .6
258 .RS 4n
259 For the specified event (string or event number), print out classes \fIevent\fR
260 has been assigned. For example:
261 .sp
262 .in +2
263 .nf
264 # auditconfig -getestate 20
265 audit class mask for event AUE_REBOOT(20) = 0x800
266 # auditconfig -getestate AUE_RENAME
267 audit class mask for event AUE_RENAME(42) = 0x30
268 .fi
269 .in -2
270 .sp
271 .RE
273 .sp
274 .ne 2
275 .na
276 \fB\fB-getflags\fR\fR
277 .ad
278 .sp .6
279 .RS 4n
280 Display the current active and configured user default audit flags. For
281 example:
282 .sp
283 .in +2
284 .nf
285 # auditconfig -getflags
286 active user default audit flags = no(0x0,0x0)
287 configured user default audit flags = ex,lo(0x40001000,0x40001000)
288 .fi
289 .in -2
290 .RE
292 .sp
293 .ne 2
294 .na
295 \fB\fB-getkaudit\fR\fR
296 .ad
297 .sp .6
298 .RS 4n
299 Get audit characteristics of the current zone. For example:
300 .sp
301 .in +2
302 .nf
303 # auditconfig -getkaudit
304 audit id = unknown(-2)
305 process preselection mask = lo,na(0x1400,0x1400)
306 terminal id (maj,min,host) = 0,0,(0.0.0.0)
307 audit session id = 0
308 .fi
309 .in -2
310 .sp
312 If the audit policy \fBperzone\fR is not set, the terminal id is that of the
313 global zone. Otherwise, it is the terminal id of the local zone.
314 .RE
316 .sp
317 .ne 2
318 .na
319 \fB\fB-getkmask\fR\fR
320 .ad
321 .sp .6
322 .RS 4n
323 Get non-attributable pre-selection mask for the current zone. For example:
324 .sp
325 .in +2
326 .nf
327 # auditconfig -getkmask
328 audit flags for non-attributable events = lo,na(0x1400,0x1400)
329 .fi
330 .in -2
331 .sp
333 If the audit policy \fBperzone\fR is not set, the kernel mask is that of the
334 global zone. Otherwise, it is that of the local zone.
335 .RE
337 .sp
338 .ne 2
339 .na
340 \fB\fB-getnaflags\fR\fR
341 .ad
342 .sp .6
343 .RS 4n
344 Display the current active and configured non-attributable audit flags. For
345 example:
346 .sp
347 .in +2
348 .nf
349 # auditconfig -getnaflags
350 active non-attributable audit flags = no(0x0,0x0)
351 configured non-attributable audit flags = lo(0x1000,0x1000)
352 .fi
353 .in -2
354 .RE
356 .sp
357 .ne 2
358 .na
359 \fB\fB-getpinfo\fR \fIpid\fR\fR
360 .ad
361 .sp .6
362 .RS 4n
363 Display the audit ID, preselection mask, terminal ID, and audit session ID for
364 the specified process.
365 .RE
367 .sp
368 .ne 2
369 .na
370 \fB\fB-getplugin\fR [\fIplugin\fR]\fR
371 .ad
372 .sp .6
373 .RS 4n
374 Display the currently installed plugins and their attributes. If \fIplugin\fR is
375 specified, \fB-getplugin\fR only shows information for that \fIplugin\fR. For
376 example:
377 .sp
378 .in +2
379 .nf
380 # auditconfig -getplugin
381 Plugin: audit_binfile (active)
382 Attributes: p_dir=/var/audit;p_fsize=0;p_minfree=0;
384 Plugin: audit_syslog (inactive)
385 Attributes: p_flags=;
387 Plugin: audit_remote (inactive)
388 Attributes: p_hosts=;p_retries=3;p_timeout=5;
389 .fi
390 .in -2
391 .RE
393 .sp
394 .ne 2
395 .na
396 \fB\fB-getpolicy\fR\fR
397 .ad
398 .sp .6
399 .RS 4n
400 Display the kernel audit policy. The \fBahlt\fR and \fBperzone\fR policies
401 reflect the settings from the global zone. If \fBperzone\fR is set, all other
402 policies reflect the local zone's settings. If \fBperzone\fR is not set, the
403 policies are machine-wide.
404 .RE
406 .sp
407 .ne 2
408 .na
409 \fB\fB-getqbufsz\fR\fR
410 .ad
411 .sp .6
412 .RS 4n
413 Get audit queue write buffer size. For example:
414 .sp
415 .in +2
416 .nf
417 # auditconfig -getqbufsz
418 audit queue buffer size (bytes) = 1024
419 .fi
420 .in -2
421 .sp
423 .RE
425 .sp
426 .ne 2
427 .na
428 \fB\fB-getqctrl\fR\fR
429 .ad
430 .sp .6
431 .RS 4n
432 Get audit queue write buffer size, audit queue \fBhiwater\fR mark, audit queue
433 \fBlowater\fR mark, audit queue \fBprod\fR interval (ticks).
434 .sp
435 .in +2
436 .nf
437 # auditconfig -getqctrl
438 audit queue hiwater mark (records) = 100
439 audit queue lowater mark (records) = 10
440 audit queue buffer size (bytes) = 1024
441 audit queue delay (ticks) = 20
442 .fi
443 .in -2
444 .sp
446 .RE
448 .sp
449 .ne 2
450 .na
451 \fB\fB-getqdelay\fR\fR
452 .ad
453 .sp .6
454 .RS 4n
455 Get interval at which audit queue is prodded to start output. For example:
456 .sp
457 .in +2
458 .nf
459 # auditconfig -getqdelay
460 audit queue delay (ticks) = 20
461 .fi
462 .in -2
463 .sp
465 .RE
467 .sp
468 .ne 2
469 .na
470 \fB\fB-getqhiwater\fR\fR
471 .ad
472 .sp .6
473 .RS 4n
474 Get high water point in undelivered audit records when audit generation will
475 block. For example:
476 .sp
477 .in +2
478 .nf
479 # ./auditconfig -getqhiwater
480 audit queue hiwater mark (records) = 100
481 .fi
482 .in -2
483 .sp
485 .RE
487 .sp
488 .ne 2
489 .na
490 \fB\fB-getqlowater\fR\fR
491 .ad
492 .sp .6
493 .RS 4n
494 Get low water point in undelivered audit records where blocked processes will
495 resume. For example:
496 .sp
497 .in +2
498 .nf
499 # auditconfig -getqlowater
500 audit queue lowater mark (records) = 10
501 .fi
502 .in -2
503 .sp
505 .RE
507 .sp
508 .ne 2
509 .na
510 \fB\fB-getstat\fR\fR
511 .ad
512 .sp .6
513 .RS 4n
514 Print current audit statistics information. For example:
515 .sp
516 .in +2
517 .nf
518 # auditconfig -getstat
519 gen nona kern aud ctl enq wrtn wblk rblk drop tot mem
520 910 1 725 184 0 910 910 0 231 0 88 48
521 .fi
522 .in -2
523 .sp
525 See \fBauditstat\fR(1M) for a description of the headings in \fB-getstat\fR
526 output.
527 .RE
529 .sp
530 .ne 2
531 .na
532 \fB\fB-gettid\fR\fR
533 .ad
534 .sp .6
535 .RS 4n
536 Print audit terminal ID for current process. For example:
537 .sp
538 .in +2
539 .nf
540 # auditconfig -gettid
541 terminal id (maj,min,host) = 235,197121,elbow(172.146.89.77)
542 .fi
543 .in -2
544 .sp
546 .RE
548 .sp
549 .ne 2
550 .na
551 \fB\fB-lsevent\fR\fR
552 .ad
553 .sp .6
554 .RS 4n
555 Display the currently configured (runtime) kernel and user level audit event
556 information.
557 .RE
559 .sp
560 .ne 2
561 .na
562 \fB\fB-lspolicy\fR\fR
563 .ad
564 .sp .6
565 .RS 4n
566 Display the kernel audit policies with a description of each policy.
567 .RE
569 .sp
570 .ne 2
571 .na
572 \fB\fB-setasid\fR \fIsession-ID\fR [\fIcmd\fR]\fR
573 .ad
574 .sp .6
575 .RS 4n
576 Execute shell or \fIcmd\fR with specified \fIsession-ID\fR. For example:
577 .sp
578 .in +2
579 .nf
580 # ./auditconfig -setasid 2000 /bin/ksh
581 #
582 # ./auditconfig -getpinfo 104485
583 audit id = abc(666)
584 process preselection mask = lo(0x1000,0x1000)
585 terminal id (maj,min,host) = 235,197121,elbow(172.146.89.77)
586 audit session id = 2000
587 .fi
588 .in -2
589 .sp
591 .RE
593 .sp
594 .ne 2
595 .na
596 \fB\fB-setaudit\fR \fIaudit-ID\fR \fIpreselect_flags\fR \fIterm-ID\fR
597 \fIsession-ID\fR [\fIcmd\fR]\fR
598 .ad
599 .sp .6
600 .RS 4n
601 Execute shell or \fIcmd\fR with the specified audit characteristics.
602 .RE
604 .sp
605 .ne 2
606 .na
607 \fB\fB-setauid\fR \fIaudit-ID\fR [\fIcmd\fR]\fR
608 .ad
609 .sp .6
610 .RS 4n
611 Execute shell or \fIcmd\fR with the specified \fIaudit-ID\fR.
612 .RE
614 .sp
615 .ne 2
616 .na
617 \fB\fB-setclass\fR \fIevent audit_flag\fR[\fI,audit_flag .\|.\|.\fR]\fR
618 .ad
619 .sp .6
620 .RS 4n
621 Map the kernel event \fIevent\fR to the classes specified by \fIaudit_flags\fR.
622 \fIevent\fR is an event number or name. An \fIaudit_flag\fR is a two character
623 string representing an audit class. See \fBaudit_control\fR(4) for further
624 information. If \fBperzone\fR is not set, this option is valid only in the
625 global zone.
626 .RE
628 .sp
629 .ne 2
630 .na
631 \fB\fB-setflags\fR \fIaudit_flags\fR\fR
632 .ad
633 .sp .6
634 .RS 4n
635 Sets the user default audit flags. For example, to set execute and login
636 auditing for all users:
637 .sp
638 .in +2
639 .nf
640 # auditconfig -setflags ex,lo
641 user default audit flags = ex,lo(0x40001000,0x40001000)
642 .fi
643 .in -2
644 .RE
646 .sp
647 .ne 2
648 .na
649 \fB\fB-setkaudit\fR \fIIP-address_type\fR \fIIP_address\fR\fR
650 .ad
651 .sp .6
652 .RS 4n
653 Set IP address of machine to specified values. \fIIP-address_type\fR is
654 \fBipv6\fR or \fBipv4\fR.
655 .sp
656 If \fBperzone\fR is not set, this option is valid only in the global zone.
657 .RE
659 .sp
660 .ne 2
661 .na
662 \fB\fB-setkmask\fR \fIaudit_flags\fR\fR
663 .ad
664 .sp .6
665 .RS 4n
666 Set non-attributes selection flags of machine.
667 .sp
668 If \fBperzone\fR is not set, this option is valid only in the global zone.
669 .RE
671 .sp
672 .ne 2
673 .na
674 \fB\fB-setnaflags\fR \fIaudit_flags\fR\fR
675 .ad
676 .sp .6
677 .RS 4n
678 Sets the non-attributable audit flags. For example:
679 .sp
680 .in +2
681 .nf
682 # auditconfig -setnaflags lo
683 non-attributable audit flags = lo(0x1000,0x1000)
684 .fi
685 .in -2
686 .RE
688 .sp
689 .ne 2
690 .na
691 \fB\fB-setplugin\fR \fIname active\fR|\fIinactive\fR [\fIattributes\fR [\fIqsize\fR]]\fR
692 .ad
693 .sp .6
694 .RS 4n
695 Configures a plugin's attributes. For example:
696 .sp
697 .in +2
698 .nf
699 # auditconfig -setplugin audit_syslog active
700 .fi
701 .in -2
702 .RE
704 .sp
705 .ne 2
706 .na
707 \fB\fB-setpmask\fR \fIpid flags\fR\fR
708 .ad
709 .sp .6
710 .RS 4n
711 Set the preselection mask of the specified process. \fBflags\fR is the ASCII
712 representation of the flags similar to that in \fBaudit_control\fR(4).
713 .sp
714 If \fBperzone\fR is not set, this option is valid only in the global zone.
715 .RE
717 .sp
718 .ne 2
719 .na
720 \fB\fB-setpolicy\fR
721 [\fI+\fR|\fI-\fR]\fIpolicy_flag\fR[\fI,policy_flag ...\fR]\fR
722 .ad
723 .sp .6
724 .RS 4n
725 Set the kernel audit policy. A policy \fIpolicy_flag\fR is literal strings that
726 denotes an audit policy. A prefix of \fB+\fR adds the policies specified to the
727 current audit policies. A prefix of \fB-\fR removes the policies specified from
728 the current audit policies. No policies can be set from a local zone unless the
729 \fBperzone\fR policy is first set from the global zone. The following are the
730 valid policy flag strings (\fBauditconfig\fR \fB-lspolicy\fR also lists the
731 current valid audit policy flag strings):
732 .sp
733 .ne 2
734 .na
735 \fB\fBall\fR\fR
736 .ad
737 .RS 16n
738 Include all policies that apply to the current zone.
739 .RE
741 .sp
742 .ne 2
743 .na
744 \fB\fBahlt\fR\fR
745 .ad
746 .RS 16n
747 Panic is called and the system dumps core if an asynchronous audit event occurs
748 that cannot be delivered because the audit queue has reached the high-water
749 mark or because there are insufficient resources to construct an audit record.
750 By default, records are dropped and a count is kept of the number of dropped
751 records.
752 .RE
754 .sp
755 .ne 2
756 .na
757 \fB\fBarge\fR\fR
758 .ad
759 .RS 16n
760 Include the \fBexecv\fR(2) system call environment arguments to the audit
761 record. This information is not included by default.
762 .RE
764 .sp
765 .ne 2
766 .na
767 \fB\fBargv\fR\fR
768 .ad
769 .RS 16n
770 Include the \fBexecv\fR(2) system call parameter arguments to the audit record.
771 This information is not included by default.
772 .RE
774 .sp
775 .ne 2
776 .na
777 \fB\fBcnt\fR\fR
778 .ad
779 .RS 16n
780 Do not suspend processes when audit resources are exhausted. Instead, drop
781 audit records and keep a count of the number of records dropped. By default,
782 process are suspended until audit resources become available.
783 .RE
785 .sp
786 .ne 2
787 .na
788 \fB\fBgroup\fR\fR
789 .ad
790 .RS 16n
791 Include the supplementary group token in audit records. By default, the group
792 token is not included.
793 .RE
795 .sp
796 .ne 2
797 .na
798 \fB\fBnone\fR\fR
799 .ad
800 .RS 16n
801 Include no policies. If used in other than the global zone, the \fBahlt\fR and
802 \fBperzone\fR policies are not changed.
803 .RE
805 .sp
806 .ne 2
807 .na
808 \fB\fBpath\fR\fR
809 .ad
810 .RS 16n
811 Add secondary path tokens to audit record. These are typically the pathnames of
812 dynamically linked shared libraries or command interpreters for shell scripts.
813 By default, they are not included.
814 .RE
816 .sp
817 .ne 2
818 .na
819 \fB\fBperzone\fR\fR
820 .ad
821 .RS 16n
822 Maintain separate configuration, queues, and logs for each zone and execute a
823 separate version of \fBauditd\fR(1M) for each zone.
824 .RE
826 .sp
827 .ne 2
828 .na
829 \fB\fBpublic\fR\fR
830 .ad
831 .RS 16n
832 Audit public files. By default, read-type operations are not audited for
833 certain files which meet \fBpublic\fR characteristics: owned by root, readable
834 by all, and not writable by all.
835 .RE
837 .sp
838 .ne 2
839 .na
840 \fB\fBtrail\fR\fR
841 .ad
842 .RS 16n
843 Include the trailer token in every audit record. By default, the trailer token
844 is not included.
845 .RE
847 .sp
848 .ne 2
849 .na
850 \fB\fBseq\fR\fR
851 .ad
852 .RS 16n
853 Include the sequence token as part of every audit record. By default, the
854 sequence token is not included. The sequence token attaches a sequence number
855 to every audit record.
856 .RE
858 .sp
859 .ne 2
860 .na
861 \fB\fBwindata_down\fR\fR
862 .ad
863 .RS 16n
864 Include in an audit record any downgraded data moved between windows. This
865 policy is available only if the system is configured with Trusted Extensions.
866 By default, this information is not included.
867 .RE
869 .sp
870 .ne 2
871 .na
872 \fB\fBwindata_up\fR\fR
873 .ad
874 .RS 16n
875 Include in an audit record any upgraded data moved between windows. This policy
876 is available only if the system is configured with Trusted Extensions. By
877 default, this information is not included.
878 .RE
880 .sp
881 .ne 2
882 .na
883 \fB\fBzonename\fR\fR
884 .ad
885 .RS 16n
886 Include the \fBzonename\fR token as part of every audit record. By default, the
887 \fBzonename\fR token is not included. The \fBzonename\fR token gives the name
888 of the zone from which the audit record was generated.
889 .RE
891 .RE
893 .sp
894 .ne 2
895 .na
896 \fB\fB-setqbufsz\fR \fIbuffer_size\fR\fR
897 .ad
898 .sp .6
899 .RS 4n
900 Set the audit queue write buffer size (bytes).
901 .RE
903 .sp
904 .ne 2
905 .na
906 \fB\fB-setqctrl\fR \fIhiwater\fR \fIlowater\fR \fIbufsz\fR \fIinterval\fR\fR
907 .ad
908 .sp .6
909 .RS 4n
910 Set the audit queue write buffer size (bytes), hiwater audit record count,
911 lowater audit record count, and wakeup interval (ticks). Valid within a local
912 zone only if \fBperzone\fR is set.
913 .RE
915 .sp
916 .ne 2
917 .na
918 \fB\fB-setqdelay\fR \fIinterval\fR\fR
919 .ad
920 .sp .6
921 .RS 4n
922 Set the audit queue wakeup interval (ticks). This determines the interval at
923 which the kernel pokes the audit queue, to write audit records to the audit
924 trail. Valid within a local zone only if \fBperzone\fR is set.
925 .RE
927 .sp
928 .ne 2
929 .na
930 \fB\fB-setqhiwater\fR \fIhiwater\fR\fR
931 .ad
932 .sp .6
933 .RS 4n
934 Set the number of undelivered audit records in the audit queue at which audit
935 record generation blocks. Valid within a local zone only if \fBperzone\fR is
936 set.
937 .RE
939 .sp
940 .ne 2
941 .na
942 \fB\fB-setqlowater\fR \fIlowater\fR\fR
943 .ad
944 .sp .6
945 .RS 4n
946 Set the number of undelivered audit records in the audit queue at which blocked
947 auditing processes unblock. Valid within a local zone only if \fBperzone\fR is
948 set.
949 .RE
951 .sp
952 .ne 2
953 .na
954 \fB\fB-setsmask\fR \fIasid flags\fR\fR
955 .ad
956 .sp .6
957 .RS 4n
958 Set the preselection mask of all processes with the specified audit session ID.
959 Valid within a local zone only if \fBperzone\fR is set.
960 .RE
962 .sp
963 .ne 2
964 .na
965 \fB\fB-setstat\fR\fR
966 .ad
967 .sp .6
968 .RS 4n
969 Reset audit statistics counters. Valid within a local zone only if
970 \fBperzone\fR is set.
971 .RE
973 .sp
974 .ne 2
975 .na
976 \fB\fB-setumask\fR \fIauid flags\fR\fR
977 .ad
978 .sp .6
979 .RS 4n
980 Set the preselection mask of all processes with the specified audit ID. Valid
981 within a local zone only if \fBperzone\fR is set.
982 .RE
984 .SH EXAMPLES
985 .LP
986 \fBExample 1 \fRUsing \fBauditconfig\fR
987 .sp
988 .LP
989 The following is an example of an \fBauditconfig\fR program:
991 .sp
992 .in +2
993 .nf
994 #
995 # map kernel audit event number 10 to the "fr" audit class
996 #
997 % auditconfig -setclass 10 fr
999 #
1000 # turn on inclusion of exec arguments in exec audit records
1001 #
1002 % auditconfig -setpolicy +argv
1003 .fi
1004 .in -2
1005 .sp
1007 .SH EXIT STATUS
1008 .ne 2
1009 .na
1010 \fB\fB0\fR\fR
1011 .ad
1012 .RS 5n
1013 Successful completion.
1014 .RE
1016 .sp
1017 .ne 2
1018 .na
1019 \fB\fB1\fR\fR
1020 .ad
1021 .RS 5n
1022 An error occurred.
1023 .RE
1025 .SH FILES
1026 .ne 2
1027 .na
1028 \fB\fB/etc/security/audit_event\fR\fR
1029 .ad
1030 .RS 29n
1031 Stores event definitions used in the audit system.
1032 .RE
1034 .sp
1035 .ne 2
1036 .na
1037 \fB\fB/etc/security/audit_class\fR\fR
1038 .ad
1039 .RS 29n
1040 Stores class definitions used in the audit system.
1041 .RE
1043 .SH ATTRIBUTES
1044 .LP
1045 See \fBattributes\fR(5) for descriptions of the following attributes:
1046 .sp
1048 .sp
1049 .TS
1050 box;
1051 c | c
1052 l | l .
1053 ATTRIBUTE TYPE ATTRIBUTE VALUE
1054 _
1055 Interface Stability Committed
1056 .TE
1058 .SH SEE ALSO
1059 .LP
1060 \fBaudit\fR(1M), \fBauditd\fR(1M), \fBauditstat\fR(1M), \fBbsmconv\fR(1M),
1061 \fBpraudit\fR(1M), \fBauditon\fR(2), \fBexecv\fR(2), \fBaudit_class\fR(4),
1062 \fBaudit_control\fR(4), \fBaudit_event\fR(4), \fBattributes\fR(5),
1063 \fBaudit_binfile\fR(5)
1064 .sp
1065 .LP
1066 See the section on Solaris Auditing in \fISystem Administration Guide: Security
1067 Services\fR.
1068 .SH NOTES
1069 .LP
1070 If plugin output is selected using \fBaudit_control\fR(4), the behavior of the
1071 system with respect to the \fB-setpolicy\fR \fB+cnt\fR and the
1072 \fB-setqhiwater\fR options is modified slightly. If \fB-setpolicy\fR \fB+cnt\fR
1073 is set, data will continue to be sent to the selected plugin, even though
1074 output to the binary audit log is stopped, pending the freeing of disk space.
1075 If \fB-setpolicy\fR \fB-cnt\fR is used, the blocking behavior is as described
1076 under OPTIONS, above. The value set for the queue high water mark is used
1077 within \fBauditd\fR as the default value for its queue limits unless overridden
1078 by means of the \fBqsize\fR attribute as described in \fBaudit_control\fR(4).
1079 .sp
1080 .LP
1081 The \fBauditconfig\fR options that modify or display process-based information
1082 are not affected by the \fBperzone\fR policy. Those that modify system audit
1083 data such as the terminal id and audit queue parameters are valid only in the
1084 global zone, unless the \fBperzone\fR policy is set. The display of a system
1085 audit reflects the local zone if \fBperzone\fR is set. Otherwise, it reflects
1086 the settings of the global zone.
1087 .sp
1088 .LP
1089 The \fB-setcond\fR option has been removed. Use \fBaudit\fR(1M) to enable or
1090 disable auditing.
1091 .sp
1092 .LP
1093 The \fB-getfsize\fR and \fB-setfsize\fR options have been removed. Use
1094 \fBaudit_binfile\fR(5) \fBp_fsize\fR to set the audit file size.