| blob | 24cb8927c209c7420e72cbb41d1f961cbdd6a626 |
1 '\" te
2 .\" Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved
3 .\" Copyright 2015, Joyent, Inc. All Rights Reserved
4 .\" Copyright (c) 2017 Peter Tribble
5 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
6 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
7 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
8 .TH AUDITCONFIG 1M "Mar 6, 2017"
9 .SH NAME
10 auditconfig \- configure auditing
11 .SH SYNOPSIS
12 .LP
13 .nf
14 \fBauditconfig\fR \fIoption\fR...
15 .fi
17 .SH DESCRIPTION
18 .LP
19 \fBauditconfig\fR provides a command line interface to get and set kernel audit
20 parameters.
21 .sp
22 .LP
23 The setting of the \fBperzone\fR policy determines the scope of the audit
24 setting controlled by \fBauditconfig\fR. If \fBperzone\fR is set, then the
25 values reflect the local zone except as noted. Otherwise, the settings are for
26 the entire system. Any restriction based on the \fBperzone\fR setting is noted
27 for each option to which it applies.
28 .sp
29 .LP
30 A non-global zone administrator can set all audit policy options except
31 \fBperzone\fR and \fBahlt\fR. \fBperzone\fR and \fBahlt\fR apply only to the
32 global zone; setting these policies requires the privileges of a global zone
33 administrator. \fBperzone\fR and \fBahlt\fR are described under the
34 \fB-setpolicy\fR option, below.
35 .SH OPTIONS
36 .ne 2
37 .na
38 \fB\fB-aconf\fR\fR
39 .ad
40 .sp .6
41 .RS 4n
42 Set the non-attributable audit mask to the value set using the \fb-setnaflags\fR
43 option. For example:
44 .sp
45 .in +2
46 .nf
47 # auditconfig -aconf
48 Configured non-attributable event mask.
49 .fi
50 .in -2
51 .sp
53 .RE
55 .sp
56 .ne 2
57 .na
58 \fB\fB-audit\fR \fIevent\fR \fIsorf\fR \fIretval\fR \fIstring\fR\fR
59 .ad
60 .sp .6
61 .RS 4n
62 This command constructs an audit record for audit event \fIevent\fR using the
63 process's audit characteristics containing a text token \fIstring\fR. The
64 return token is constructed from the \fIsorf\fR (success/failure flag) and the
65 \fIretval\fR (return value). The event is type \fBchar*\fR, the \fIsorf\fR is
66 0/1 for success/failure, \fIretval\fR is an errno value, \fIstring\fR is type
67 \fB*char\fR. This command is useful for constructing an audit record with a
68 shell script. An example of this option:
69 .sp
70 .in +2
71 .nf
72 # auditconfig -audit AUE_ftpd 0 0 "test string"
73 #
75 audit record from audit trail:
76 header,76,2,ftp access,,Fri Dec 08 08:44:02 2000, + 669 msec
77 subject,abc,root,other,root,other,104449,102336,235 197121 elbow
78 text,test string
79 return,success,0
80 .fi
81 .in -2
82 .sp
84 .RE
86 .sp
87 .ne 2
88 .na
89 \fB\fB-chkaconf\fR\fR
90 .ad
91 .sp .6
92 .RS 4n
93 Checks that the current non-attributable event flags set in the kernel
94 matches the configuration. If the runtime class mask of a
95 kernel audit event does not match the configured class mask, a mismatch is
96 reported.
97 .RE
99 .sp
100 .ne 2
101 .na
102 \fB\fB-chkconf\fR\fR
103 .ad
104 .sp .6
105 .RS 4n
106 Check the configuration of kernel audit event to class mappings. If the runtime
107 class mask of a kernel audit event does not match the configured class mask, a
108 mismatch is reported.
109 .RE
111 .sp
112 .ne 2
113 .na
114 \fB\fB-conf\fR\fR
115 .ad
116 .sp .6
117 .RS 4n
118 Configure kernel audit event to class mappings. Runtime class mappings are
119 changed to match those in the audit event to class database file.
120 .RE
122 .sp
123 .ne 2
124 .na
125 \fB\fB-getasid\fR\fR
126 .ad
127 .sp .6
128 .RS 4n
129 Prints the audit session ID of the current process. For example:
130 .sp
131 .in +2
132 .nf
133 # auditconfig -getasid
134 audit session id = 102336
135 .fi
136 .in -2
137 .sp
139 .RE
141 .sp
142 .ne 2
143 .na
144 \fB\fB-getaudit\fR\fR
145 .ad
146 .sp .6
147 .RS 4n
148 Returns the audit characteristics of the current process.
149 .sp
150 .in +2
151 .nf
152 # auditconfig -getaudit
153 audit id = abc(666)
154 process preselection mask = lo(0x1000,0x1000)
155 terminal id (maj,min,host) = 235,197121,elbow(172.146.89.77)
156 audit session id = 102336
157 .fi
158 .in -2
159 .sp
161 .RE
163 .sp
164 .ne 2
165 .na
166 \fB\fB-getauid\fR\fR
167 .ad
168 .sp .6
169 .RS 4n
170 Prints the audit ID of the current process. For example:
171 .sp
172 .in +2
173 .nf
174 # auditconfig -getauid
175 audit id = abc(666)
176 .fi
177 .in -2
178 .sp
180 .RE
182 .sp
183 .ne 2
184 .na
185 \fB\fB-getcar\fR\fR
186 .ad
187 .sp .6
188 .RS 4n
189 Prints current active root location (anchored from root [or local zone root] at
190 system boot). For example:
191 .sp
192 .in +2
193 .nf
194 # auditconfig -getcar
195 current active root = /
196 .fi
197 .in -2
198 .sp
200 .RE
202 .sp
203 .ne 2
204 .na
205 \fB\fB-getclass\fR \fIevent\fR\fR
206 .ad
207 .sp .6
208 .RS 4n
209 Display the preselection mask associated with the specified kernel audit event.
210 \fIevent\fR is the kernel event number or event name.
211 .RE
213 .sp
214 .ne 2
215 .na
216 \fB\fB-getcond\fR\fR
217 .ad
218 .sp .6
219 .RS 4n
220 Display the kernel audit condition. The condition displayed is the literal
221 string \fBauditing\fR meaning auditing is enabled and turned on (the kernel
222 audit module is constructing and queuing audit records); \fBnoaudit\fR, meaning
223 auditing is enabled but turned off (the kernel audit module is not constructing
224 and queuing audit records); or \fBnospace\fR, meaning there is no space for
225 saving audit records. See \fBauditon\fR(2) and \fBauditd\fR(1M) for further
226 information.
227 .RE
229 .sp
230 .ne 2
231 .na
232 \fB\fB-getcwd\fR\fR
233 .ad
234 .sp .6
235 .RS 4n
236 Prints current working directory (anchored from zone root at system boot). For
237 example:
238 .sp
239 .in +2
240 .nf
241 # cd /usr/tmp
242 # auditconfig -getcwd
243 current working directory = /var/tmp
244 .fi
245 .in -2
246 .sp
247 .RE
249 .sp
250 .ne 2
251 .na
252 \fB\fB-getestate\fR \fIevent\fR\fR
253 .ad
254 .sp .6
255 .RS 4n
256 For the specified event (string or event number), print out classes \fIevent\fR
257 has been assigned. For example:
258 .sp
259 .in +2
260 .nf
261 # auditconfig -getestate 20
262 audit class mask for event AUE_REBOOT(20) = 0x800
263 # auditconfig -getestate AUE_RENAME
264 audit class mask for event AUE_RENAME(42) = 0x30
265 .fi
266 .in -2
267 .sp
268 .RE
270 .sp
271 .ne 2
272 .na
273 \fB\fB-getflags\fR\fR
274 .ad
275 .sp .6
276 .RS 4n
277 Display the current active and configured user default audit flags. For
278 example:
279 .sp
280 .in +2
281 .nf
282 # auditconfig -getflags
283 active user default audit flags = no(0x0,0x0)
284 configured user default audit flags = ex,lo(0x40001000,0x40001000)
285 .fi
286 .in -2
287 .RE
289 .sp
290 .ne 2
291 .na
292 \fB\fB-getkaudit\fR\fR
293 .ad
294 .sp .6
295 .RS 4n
296 Get audit characteristics of the current zone. For example:
297 .sp
298 .in +2
299 .nf
300 # auditconfig -getkaudit
301 audit id = unknown(-2)
302 process preselection mask = lo,na(0x1400,0x1400)
303 terminal id (maj,min,host) = 0,0,(0.0.0.0)
304 audit session id = 0
305 .fi
306 .in -2
307 .sp
309 If the audit policy \fBperzone\fR is not set, the terminal id is that of the
310 global zone. Otherwise, it is the terminal id of the local zone.
311 .RE
313 .sp
314 .ne 2
315 .na
316 \fB\fB-getkmask\fR\fR
317 .ad
318 .sp .6
319 .RS 4n
320 Get non-attributable pre-selection mask for the current zone. For example:
321 .sp
322 .in +2
323 .nf
324 # auditconfig -getkmask
325 audit flags for non-attributable events = lo,na(0x1400,0x1400)
326 .fi
327 .in -2
328 .sp
330 If the audit policy \fBperzone\fR is not set, the kernel mask is that of the
331 global zone. Otherwise, it is that of the local zone.
332 .RE
334 .sp
335 .ne 2
336 .na
337 \fB\fB-getnaflags\fR\fR
338 .ad
339 .sp .6
340 .RS 4n
341 Display the current active and configured non-attributable audit flags. For
342 example:
343 .sp
344 .in +2
345 .nf
346 # auditconfig -getnaflags
347 active non-attributable audit flags = no(0x0,0x0)
348 configured non-attributable audit flags = lo(0x1000,0x1000)
349 .fi
350 .in -2
351 .RE
353 .sp
354 .ne 2
355 .na
356 \fB\fB-getpinfo\fR \fIpid\fR\fR
357 .ad
358 .sp .6
359 .RS 4n
360 Display the audit ID, preselection mask, terminal ID, and audit session ID for
361 the specified process.
362 .RE
364 .sp
365 .ne 2
366 .na
367 \fB\fB-getplugin\fR [\fIplugin\fR]\fR
368 .ad
369 .sp .6
370 .RS 4n
371 Display the currently installed plugins and their attributes. If \fIplugin\fR is
372 specified, \fB-getplugin\fR only shows information for that \fIplugin\fR. For
373 example:
374 .sp
375 .in +2
376 .nf
377 # auditconfig -getplugin
378 Plugin: audit_binfile (active)
379 Attributes: p_dir=/var/audit;p_fsize=0;p_minfree=0;
381 Plugin: audit_syslog (inactive)
382 Attributes: p_flags=;
384 Plugin: audit_remote (inactive)
385 Attributes: p_hosts=;p_retries=3;p_timeout=5;
386 .fi
387 .in -2
388 .RE
390 .sp
391 .ne 2
392 .na
393 \fB\fB-getpolicy\fR\fR
394 .ad
395 .sp .6
396 .RS 4n
397 Display the kernel audit policy. The \fBahlt\fR and \fBperzone\fR policies
398 reflect the settings from the global zone. If \fBperzone\fR is set, all other
399 policies reflect the local zone's settings. If \fBperzone\fR is not set, the
400 policies are machine-wide.
401 .RE
403 .sp
404 .ne 2
405 .na
406 \fB\fB-getqbufsz\fR\fR
407 .ad
408 .sp .6
409 .RS 4n
410 Get audit queue write buffer size. For example:
411 .sp
412 .in +2
413 .nf
414 # auditconfig -getqbufsz
415 audit queue buffer size (bytes) = 1024
416 .fi
417 .in -2
418 .sp
420 .RE
422 .sp
423 .ne 2
424 .na
425 \fB\fB-getqctrl\fR\fR
426 .ad
427 .sp .6
428 .RS 4n
429 Get audit queue write buffer size, audit queue \fBhiwater\fR mark, audit queue
430 \fBlowater\fR mark, audit queue \fBprod\fR interval (ticks).
431 .sp
432 .in +2
433 .nf
434 # auditconfig -getqctrl
435 audit queue hiwater mark (records) = 100
436 audit queue lowater mark (records) = 10
437 audit queue buffer size (bytes) = 1024
438 audit queue delay (ticks) = 20
439 .fi
440 .in -2
441 .sp
443 .RE
445 .sp
446 .ne 2
447 .na
448 \fB\fB-getqdelay\fR\fR
449 .ad
450 .sp .6
451 .RS 4n
452 Get interval at which audit queue is prodded to start output. For example:
453 .sp
454 .in +2
455 .nf
456 # auditconfig -getqdelay
457 audit queue delay (ticks) = 20
458 .fi
459 .in -2
460 .sp
462 .RE
464 .sp
465 .ne 2
466 .na
467 \fB\fB-getqhiwater\fR\fR
468 .ad
469 .sp .6
470 .RS 4n
471 Get high water point in undelivered audit records when audit generation will
472 block. For example:
473 .sp
474 .in +2
475 .nf
476 # auditconfig -getqhiwater
477 audit queue hiwater mark (records) = 100
478 .fi
479 .in -2
480 .sp
482 .RE
484 .sp
485 .ne 2
486 .na
487 \fB\fB-getqlowater\fR\fR
488 .ad
489 .sp .6
490 .RS 4n
491 Get low water point in undelivered audit records where blocked processes will
492 resume. For example:
493 .sp
494 .in +2
495 .nf
496 # auditconfig -getqlowater
497 audit queue lowater mark (records) = 10
498 .fi
499 .in -2
500 .sp
502 .RE
504 .sp
505 .ne 2
506 .na
507 \fB\fB-getstat\fR\fR
508 .ad
509 .sp .6
510 .RS 4n
511 Print current audit statistics information. For example:
512 .sp
513 .in +2
514 .nf
515 # auditconfig -getstat
516 gen nona kern aud ctl enq wrtn wblk rblk drop tot mem
517 910 1 725 184 0 910 910 0 231 0 88 48
518 .fi
519 .in -2
520 .sp
522 See \fBauditstat\fR(1M) for a description of the headings in \fB-getstat\fR
523 output.
524 .RE
526 .sp
527 .ne 2
528 .na
529 \fB\fB-gettid\fR\fR
530 .ad
531 .sp .6
532 .RS 4n
533 Print audit terminal ID for current process. For example:
534 .sp
535 .in +2
536 .nf
537 # auditconfig -gettid
538 terminal id (maj,min,host) = 235,197121,elbow(172.146.89.77)
539 .fi
540 .in -2
541 .sp
543 .RE
545 .sp
546 .ne 2
547 .na
548 \fB\fB-lsevent\fR\fR
549 .ad
550 .sp .6
551 .RS 4n
552 Display the currently configured (runtime) kernel and user level audit event
553 information.
554 .RE
556 .sp
557 .ne 2
558 .na
559 \fB\fB-lspolicy\fR\fR
560 .ad
561 .sp .6
562 .RS 4n
563 Display the kernel audit policies with a description of each policy.
564 .RE
566 .sp
567 .ne 2
568 .na
569 \fB\fB-setasid\fR \fIsession-ID\fR [\fIcmd\fR]\fR
570 .ad
571 .sp .6
572 .RS 4n
573 Execute shell or \fIcmd\fR with specified \fIsession-ID\fR. For example:
574 .sp
575 .in +2
576 .nf
577 # auditconfig -setasid 2000 /bin/ksh
578 #
579 # auditconfig -getpinfo 104485
580 audit id = abc(666)
581 process preselection mask = lo(0x1000,0x1000)
582 terminal id (maj,min,host) = 235,197121,elbow(172.146.89.77)
583 audit session id = 2000
584 .fi
585 .in -2
586 .sp
588 .RE
590 .sp
591 .ne 2
592 .na
593 \fB\fB-setaudit\fR \fIaudit-ID\fR \fIpreselect_flags\fR \fIterm-ID\fR
594 \fIsession-ID\fR [\fIcmd\fR]\fR
595 .ad
596 .sp .6
597 .RS 4n
598 Execute shell or \fIcmd\fR with the specified audit characteristics.
599 .RE
601 .sp
602 .ne 2
603 .na
604 \fB\fB-setauid\fR \fIaudit-ID\fR [\fIcmd\fR]\fR
605 .ad
606 .sp .6
607 .RS 4n
608 Execute shell or \fIcmd\fR with the specified \fIaudit-ID\fR.
609 .RE
611 .sp
612 .ne 2
613 .na
614 \fB\fB-setclass\fR \fIevent audit_flag\fR[\fI,audit_flag .\|.\|.\fR]\fR
615 .ad
616 .sp .6
617 .RS 4n
618 Map the kernel event \fIevent\fR to the classes specified by \fIaudit_flags\fR.
619 \fIevent\fR is an event number or name. An \fIaudit_flag\fR is a two character
620 string representing an audit class. If \fBperzone\fR is not set, this option
621 is valid only in the global zone.
622 .RE
624 .sp
625 .ne 2
626 .na
627 \fB\fB-setflags\fR \fIaudit_flags\fR\fR
628 .ad
629 .sp .6
630 .RS 4n
631 Sets the user default audit flags. For example, to set execute and login
632 auditing for all users:
633 .sp
634 .in +2
635 .nf
636 # auditconfig -setflags ex,lo
637 user default audit flags = ex,lo(0x40001000,0x40001000)
638 .fi
639 .in -2
640 .RE
642 .sp
643 .ne 2
644 .na
645 \fB\fB-setkaudit\fR \fIIP-address_type\fR \fIIP_address\fR\fR
646 .ad
647 .sp .6
648 .RS 4n
649 Set IP address of machine to specified values. \fIIP-address_type\fR is
650 \fBipv6\fR or \fBipv4\fR.
651 .sp
652 If \fBperzone\fR is not set, this option is valid only in the global zone.
653 .RE
655 .sp
656 .ne 2
657 .na
658 \fB\fB-setkmask\fR \fIaudit_flags\fR\fR
659 .ad
660 .sp .6
661 .RS 4n
662 Set non-attributes selection flags of machine.
663 .sp
664 If \fBperzone\fR is not set, this option is valid only in the global zone.
665 .RE
667 .sp
668 .ne 2
669 .na
670 \fB\fB-setnaflags\fR \fIaudit_flags\fR\fR
671 .ad
672 .sp .6
673 .RS 4n
674 Sets the non-attributable audit flags. For example:
675 .sp
676 .in +2
677 .nf
678 # auditconfig -setnaflags lo
679 non-attributable audit flags = lo(0x1000,0x1000)
680 .fi
681 .in -2
682 .RE
684 .sp
685 .ne 2
686 .na
687 \fB\fB-setplugin\fR \fIname active\fR|\fIinactive\fR [\fIattributes\fR [\fIqsize\fR]]\fR
688 .ad
689 .sp .6
690 .RS 4n
691 Configures a plugin's attributes. For example:
692 .sp
693 .in +2
694 .nf
695 # auditconfig -setplugin audit_syslog active
696 .fi
697 .in -2
698 .RE
700 .sp
701 .ne 2
702 .na
703 \fB\fB-setpmask\fR \fIpid flags\fR\fR
704 .ad
705 .sp .6
706 .RS 4n
707 Set the preselection mask of the specified process.
708 .sp
709 If \fBperzone\fR is not set, this option is valid only in the global zone.
710 .RE
712 .sp
713 .ne 2
714 .na
715 \fB\fB-setpolicy\fR
716 [\fI+\fR|\fI-\fR]\fIpolicy_flag\fR[\fI,policy_flag ...\fR]\fR
717 .ad
718 .sp .6
719 .RS 4n
720 Set the kernel audit policy. A policy \fIpolicy_flag\fR is literal strings that
721 denotes an audit policy. A prefix of \fB+\fR adds the policies specified to the
722 current audit policies. A prefix of \fB-\fR removes the policies specified from
723 the current audit policies. No policies can be set from a local zone unless the
724 \fBperzone\fR policy is first set from the global zone. The following are the
725 valid policy flag strings (\fBauditconfig\fR \fB-lspolicy\fR also lists the
726 current valid audit policy flag strings):
727 .sp
728 .ne 2
729 .na
730 \fB\fBall\fR\fR
731 .ad
732 .RS 16n
733 Include all policies that apply to the current zone.
734 .RE
736 .sp
737 .ne 2
738 .na
739 \fB\fBahlt\fR\fR
740 .ad
741 .RS 16n
742 Panic is called and the system dumps core if an asynchronous audit event occurs
743 that cannot be delivered because the audit queue has reached the high-water
744 mark or because there are insufficient resources to construct an audit record.
745 By default, records are dropped and a count is kept of the number of dropped
746 records.
747 .RE
749 .sp
750 .ne 2
751 .na
752 \fB\fBarge\fR\fR
753 .ad
754 .RS 16n
755 Include the \fBexecv\fR(2) system call environment arguments to the audit
756 record. This information is not included by default.
757 .RE
759 .sp
760 .ne 2
761 .na
762 \fB\fBargv\fR\fR
763 .ad
764 .RS 16n
765 Include the \fBexecv\fR(2) system call parameter arguments to the audit record.
766 This information is not included by default.
767 .RE
769 .sp
770 .ne 2
771 .na
772 \fB\fBcnt\fR\fR
773 .ad
774 .RS 16n
775 Do not suspend processes when audit resources are exhausted. Instead, drop
776 audit records and keep a count of the number of records dropped. By default,
777 process are suspended until audit resources become available.
778 .RE
780 .sp
781 .ne 2
782 .na
783 \fB\fBgroup\fR\fR
784 .ad
785 .RS 16n
786 Include the supplementary group token in audit records. By default, the group
787 token is not included.
788 .RE
790 .sp
791 .ne 2
792 .na
793 \fB\fBnone\fR\fR
794 .ad
795 .RS 16n
796 Include no policies. If used in other than the global zone, the \fBahlt\fR and
797 \fBperzone\fR policies are not changed.
798 .RE
800 .sp
801 .ne 2
802 .na
803 \fB\fBpath\fR\fR
804 .ad
805 .RS 16n
806 Add secondary path tokens to audit record. These are typically the pathnames of
807 dynamically linked shared libraries or command interpreters for shell scripts.
808 By default, they are not included.
809 .RE
811 .sp
812 .ne 2
813 .na
814 \fB\fBperzone\fR\fR
815 .ad
816 .RS 16n
817 Maintain separate configuration, queues, and logs for each zone and execute a
818 separate version of \fBauditd\fR(1M) for each zone.
819 .RE
821 .sp
822 .ne 2
823 .na
824 \fB\fBpublic\fR\fR
825 .ad
826 .RS 16n
827 Audit public files. By default, read-type operations are not audited for
828 certain files which meet \fBpublic\fR characteristics: owned by root, readable
829 by all, and not writable by all.
830 .RE
832 .sp
833 .ne 2
834 .na
835 \fB\fBtrail\fR\fR
836 .ad
837 .RS 16n
838 Include the trailer token in every audit record. By default, the trailer token
839 is not included.
840 .RE
842 .sp
843 .ne 2
844 .na
845 \fB\fBseq\fR\fR
846 .ad
847 .RS 16n
848 Include the sequence token as part of every audit record. By default, the
849 sequence token is not included. The sequence token attaches a sequence number
850 to every audit record.
851 .RE
853 .sp
854 .ne 2
855 .na
856 \fB\fBwindata_down\fR\fR
857 .ad
858 .RS 16n
859 Include in an audit record any downgraded data moved between windows. This
860 policy is available only if the system is configured with Trusted Extensions.
861 By default, this information is not included.
862 .RE
864 .sp
865 .ne 2
866 .na
867 \fB\fBwindata_up\fR\fR
868 .ad
869 .RS 16n
870 Include in an audit record any upgraded data moved between windows. This policy
871 is available only if the system is configured with Trusted Extensions. By
872 default, this information is not included.
873 .RE
875 .sp
876 .ne 2
877 .na
878 \fB\fBzonename\fR\fR
879 .ad
880 .RS 16n
881 Include the \fBzonename\fR token as part of every audit record. By default, the
882 \fBzonename\fR token is not included. The \fBzonename\fR token gives the name
883 of the zone from which the audit record was generated.
884 .RE
886 .RE
888 .sp
889 .ne 2
890 .na
891 \fB\fB-setqbufsz\fR \fIbuffer_size\fR\fR
892 .ad
893 .sp .6
894 .RS 4n
895 Set the audit queue write buffer size (bytes).
896 .RE
898 .sp
899 .ne 2
900 .na
901 \fB\fB-setqctrl\fR \fIhiwater\fR \fIlowater\fR \fIbufsz\fR \fIinterval\fR\fR
902 .ad
903 .sp .6
904 .RS 4n
905 Set the audit queue write buffer size (bytes), hiwater audit record count,
906 lowater audit record count, and wakeup interval (ticks). Valid within a local
907 zone only if \fBperzone\fR is set.
908 .RE
910 .sp
911 .ne 2
912 .na
913 \fB\fB-setqdelay\fR \fIinterval\fR\fR
914 .ad
915 .sp .6
916 .RS 4n
917 Set the audit queue wakeup interval (ticks). This determines the interval at
918 which the kernel pokes the audit queue, to write audit records to the audit
919 trail. Valid within a local zone only if \fBperzone\fR is set.
920 .RE
922 .sp
923 .ne 2
924 .na
925 \fB\fB-setqhiwater\fR \fIhiwater\fR\fR
926 .ad
927 .sp .6
928 .RS 4n
929 Set the number of undelivered audit records in the audit queue at which audit
930 record generation blocks. Valid within a local zone only if \fBperzone\fR is
931 set.
932 .RE
934 .sp
935 .ne 2
936 .na
937 \fB\fB-setqlowater\fR \fIlowater\fR\fR
938 .ad
939 .sp .6
940 .RS 4n
941 Set the number of undelivered audit records in the audit queue at which blocked
942 auditing processes unblock. Valid within a local zone only if \fBperzone\fR is
943 set.
944 .RE
946 .sp
947 .ne 2
948 .na
949 \fB\fB-setsmask\fR \fIasid flags\fR\fR
950 .ad
951 .sp .6
952 .RS 4n
953 Set the preselection mask of all processes with the specified audit session ID.
954 Valid within a local zone only if \fBperzone\fR is set.
955 .RE
957 .sp
958 .ne 2
959 .na
960 \fB\fB-setstat\fR\fR
961 .ad
962 .sp .6
963 .RS 4n
964 Reset audit statistics counters. Valid within a local zone only if
965 \fBperzone\fR is set.
966 .RE
968 .sp
969 .ne 2
970 .na
971 \fB\fB-setumask\fR \fIauid flags\fR\fR
972 .ad
973 .sp .6
974 .RS 4n
975 Set the preselection mask of all processes with the specified audit ID. Valid
976 within a local zone only if \fBperzone\fR is set.
977 .RE
979 .SH EXAMPLES
980 .LP
981 \fBExample 1 \fRUsing \fBauditconfig\fR
982 .sp
983 .LP
984 The following is an example of an \fBauditconfig\fR program:
986 .sp
987 .in +2
988 .nf
989 #
990 # map kernel audit event number 10 to the "fr" audit class
991 #
992 % auditconfig -setclass 10 fr
994 #
995 # turn on inclusion of exec arguments in exec audit records
996 #
997 % auditconfig -setpolicy +argv
998 .fi
999 .in -2
1000 .sp
1002 .SH EXIT STATUS
1003 .ne 2
1004 .na
1005 \fB\fB0\fR\fR
1006 .ad
1007 .RS 5n
1008 Successful completion.
1009 .RE
1011 .sp
1012 .ne 2
1013 .na
1014 \fB\fB1\fR\fR
1015 .ad
1016 .RS 5n
1017 An error occurred.
1018 .RE
1020 .SH FILES
1021 .ne 2
1022 .na
1023 \fB\fB/etc/security/audit_event\fR\fR
1024 .ad
1025 .RS 29n
1026 Stores event definitions used in the audit system.
1027 .RE
1029 .sp
1030 .ne 2
1031 .na
1032 \fB\fB/etc/security/audit_class\fR\fR
1033 .ad
1034 .RS 29n
1035 Stores class definitions used in the audit system.
1036 .RE
1038 .SH ATTRIBUTES
1039 .LP
1040 See \fBattributes\fR(5) for descriptions of the following attributes:
1041 .sp
1043 .sp
1044 .TS
1045 box;
1046 c | c
1047 l | l .
1048 ATTRIBUTE TYPE ATTRIBUTE VALUE
1049 _
1050 Interface Stability Committed
1051 .TE
1053 .SH SEE ALSO
1054 .LP
1055 \fBaudit\fR(1M), \fBauditd\fR(1M), \fBauditstat\fR(1M),
1056 \fBpraudit\fR(1M), \fBauditon\fR(2), \fBexecv\fR(2), \fBaudit_class\fR(4),
1057 \fBaudit_event\fR(4), \fBattributes\fR(5),
1058 \fBaudit_binfile\fR(5), \fBaudit_remote\fR(5), \fBaudit_syslog\fR(5)
1059 .SH NOTES
1060 .LP
1061 If the \fBaudit_remote\fR or \fBaudit_syslog\fR plugins are active, the
1062 behavior of the system with respect to the \fB-setpolicy\fR \fB+cnt\fR and the
1063 \fB-setqhiwater\fR options is modified slightly. If \fB-setpolicy\fR \fB+cnt\fR
1064 is set, data will continue to be sent to the selected plugin, even though
1065 output to the binary audit log is stopped, pending the freeing of disk space.
1066 If \fB-setpolicy\fR \fB-cnt\fR is used, the blocking behavior is as described
1067 under OPTIONS, above. The value set for the queue high water mark is used
1068 within \fBauditd\fR as the default value for its queue limits unless overridden
1069 by means of the \fBqsize\fR attribute.
1070 .sp
1071 .LP
1072 The \fBauditconfig\fR options that modify or display process-based information
1073 are not affected by the \fBperzone\fR policy. Those that modify system audit
1074 data such as the terminal id and audit queue parameters are valid only in the
1075 global zone, unless the \fBperzone\fR policy is set. The display of a system
1076 audit reflects the local zone if \fBperzone\fR is set. Otherwise, it reflects
1077 the settings of the global zone.
1078 .sp
1079 .LP
1080 The \fB-setcond\fR option has been removed. Use \fBaudit\fR(1M) to enable or
1081 disable auditing.
1082 .sp
1083 .LP
1084 The \fB-getfsize\fR and \fB-setfsize\fR options have been removed. Use
1085 \fBaudit_binfile\fR(5) \fBp_fsize\fR to set the audit file size.