1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
|
'\" te
.\" Copyright (c) 2017 Peter Tribble
.\" Copyright (c) 1993, Sun Microsystems, Inc. All Rights Reserved.
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
.\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
.\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.TH AUDIT 1M "Mar 6, 2017"
.SH NAME
audit \- control the behavior of the audit daemon
.SH SYNOPSIS
.LP
.nf
\fBaudit\fR \fB-n\fR | \fB-s\fR | \fB-t\fR | \fB-v\fR
.fi
.SH DESCRIPTION
.LP
The \fBaudit\fR command is the system administrator's interface to maintaining
the audit daemon \fBauditd\fR(1M). The audit daemon can be stopped, started, or
notified to reread the configuration, stored in \fBsmf\fR(5) and managed using
the \fBauditconfig\fR(1M) command.
.SH OPTIONS
.ne 2
.na
\fB\fB-n\fR\fR
.ad
.RS 11n
Notify the audit daemon to close the current audit file and open a new audit
file in the current audit directory.
.RE
.sp
.ne 2
.na
\fB\fB-s\fR\fR
.ad
.RS 11n
Validates the audit service configuration and, if correct, notify the audit
daemon to reread the audit configuration. If the audit daemon is not running,
the audit daemon is started.
.RE
.sp
.ne 2
.na
\fB\fB-t\fR\fR
.ad
.RS 11n
Direct the audit daemon to close the current audit trail file, disable
auditing, and die. Use \fB-s\fR to restart auditing.
.RE
.sp
.ne 2
.na
\fB\fB-v\fR
.ad
.RS 11n
Validate the audit service configuration. At least one plugin must be active;
if that plugin is \fBaudit_binfile\fR then its \fBp_dir\fR attribute must
contain at least one valid directory, and its \fBp_minfree\fR attribute must
be between 0 and 100.
.RE
.SH DIAGNOSTICS
.LP
The \fBaudit\fR command will exit with \fB0\fR upon success and a positive
integer upon failure.
.SH ATTRIBUTES
.LP
See \fBattributes\fR(5) for descriptions of the following attributes:
.sp
.sp
.TS
box;
c | c
l | l .
ATTRIBUTE TYPE ATTRIBUTE VALUE
_
Stability Evolving
.TE
.SH SEE ALSO
.LP
\fBpraudit\fR(1M), \fBauditconfig\fR(1M), \fBaudit\fR(2), \fBsmf\fR(5),
\fBattributes\fR(5)
.SH NOTES
.LP
The \fB-v\fR option can be used in any zone, but the \fB-t\fR, \fB-s\fR, and
\fB-n\fR options are valid only in local zones and, then, only if the
\fBperzone\fR audit policy is set. See \fBauditd\fR(1M) and
\fBauditconfig\fR(1M) for per-zone audit configuration.
|
