Enabling and Disabling the Audit Service (Tasks)

The audit service is enabled by default and configured by the auditconfig command. If the perzone audit policy is set in the global zone, zone administrators can enable, refresh, and disable the service in their non-global zones.

How to Refresh the Audit Service

This procedure updates the audit service when you have changed the configuration of an audit plugin after the audit service is enabled.

Before You Begin

You must be assigned the Audit Control rights profile.

1. Become an administrator with the required security attributes.

   For more information, see How to Obtain Administrative Rights.

2. Refresh the audit service.

   # audit -s

   ---

   Note - When you refresh the audit service, all temporary configuration settings are lost. Audit policy and queue controls allow temporary settings. For more information, see the auditconfig(1M) man page.

   ---

3. Update the preselection masks of users who are currently being audited.

   Audit records are generated based on the audit preselection mask that is associated with each process. Refreshing the audit service does not change the masks of existing processes. To explicitly reset the preselection mask for an existing process, see How to Update the Preselection Mask of Logged In Users.

Example 28-22 Refreshing an Enabled Audit Service

In this example, the administrator reconfigures auditing, verifies the changes, then refreshes the audit service.

• First, the administrator adds a temporary policy.

  # auditconfig -t -setpolicy +zonename
  # auditconfig -getpolicy
  configured audit policies = ahlt,arge,argv,perzone
  active audit policies = ahlt,arge,argv,perzone,zonename

• Then, the administrator specifies queue controls.

  # auditconfig -setqctrl 200 20 0 0
  # auditconfig -getqctrl
  configured audit queue hiwater mark (records) = 200
  configured audit queue lowater mark (records) = 20
  configured audit queue buffer size (bytes) = 8192
  configured audit queue delay (ticks) = 20
  active audit queue hiwater mark (records) = 200
  active audit queue lowater mark (records) = 20
  active audit queue buffer size (bytes) = 8192
  active audit queue delay (ticks) = 20

• Then, the administrator specifies plugin attributes.

  • For the audit_binfile plugin, the administrator removes the qsize value.

    # auditconfig -getplugin audit_binfile
    Plugin: audit_binfile (active)
        Attributes: p_dir=/audit/sys1.1,/var/audit;
        p_minfree=2;p_fsize=4G;
    Queue size: 200 
    # auditconfig -setplugin audit_binfile active "" ""
    # auditconfig -getplugin audit_binfile
    Plugin: audit_binfile (active)
        Attributes: p_dir=/audit/sys1.1,/var/audit
     p_minfree=2;p_fsize=4G;

    The final empty quotation marks ("") set the queue size for the plugin to the default.

  • For the audit_syslog plugin, the administrator specifies that successful login and logout events and failed executables be sent to syslog. The qsize for this plugin is set to 50.

    # auditconfig -setplugin audit_syslog active p_flags=+lo,-ex 50
    # auditconfig -getplugin audit_syslog
    auditconfig -getplugin audit_syslog
    Plugin: audit_syslog (active)
        Attributes: p_flags=+lo,-ex;
        Queue size: 50

  • The administrator does not configure or use the audit_remote plugin.

• Then, the administrator refreshes the audit service and verifies the configuration.

  • The temporary zonename policy is no longer set.

    # audit -s
    # auditconfig -getpolicy
    configured audit policies = ahlt,arge,argv,perzone
    active audit policies = ahlt,arge,argv,perzone

  • The queue controls remain the same.

    # auditconfig -getqctrl
    configured audit queue hiwater mark (records) = 200
    configured audit queue lowater mark (records) = 20
    configured audit queue buffer size (bytes) = 8192
    configured audit queue delay (ticks) = 20
    active audit queue hiwater mark (records) = 200
    active audit queue lowater mark (records) = 20
    active audit queue buffer size (bytes) = 8192
    active audit queue delay (ticks) = 20

  • The audit_binfile plugin does not have a specified queue size. The audit_syslog plugin has a specified queue size.

    # auditconfig -getplugin
    Plugin: audit_binfile (active)
        Attributes: p_dir=/var/audit;p_fsize=4G;p_minfree=2;
    
    Plugin: audit_syslog (active)
        Attributes: p_flags=+lo,-ex;
        Queue size: 50 
    ...

How to Disable the Audit Service

This procedure shows how to disable auditing in the global zone and in a non-global zone when the perzone audit policy is set.

• If the perzone audit policy is not set, auditing is disabled for all zones.

• If the perzone audit policy is set in the global zone, the policy remains in effect in the non-global zones that have enabled auditing.

  Because the perzone policy is set in the global zone, the non-global zone continues to collect audit records across global zone reboots and non-global zone reboots.

Before You Begin

You must be assigned the Audit Control rights profile.

1. Become an administrator with the required security attributes.

   For more information, see How to Obtain Administrative Rights.

2. Run the audit -t command to disable the audit service.

   For more information, see the audit(1M) and auditd(1M) man pages.

   • In the global zone, disable the audit service.

     # audit -t

     If the perzone audit policy is not set, this command disables auditing in all zones.

   • In a non-global zone, disable the audit service.

     If the perzone audit policy is set, the non-global zone administrator must disable the service in the non-global zone.

     zone1 # audit -t

How to Enable the Audit Service

This procedure enables the audit service for all zones after the service is disabled by an administrator. To start the audit service in a non-global zone, see Example 28-23.

Before You Begin

To enable or disable the audit service, you must be assigned the Audit Control rights profile.

1. Become an administrator with the required security attributes.

   For more information, see How to Obtain Administrative Rights.

2. Use the audit -s command to enable the audit service.

   # audit -s

   For more information, see the audit(1M) man page.

3. Verify that auditing is enabled.

   # auditconfig -getcond
   audit condition = auditing

Example 28-23 Enabling Auditing in a Non-Global Zone

In this example, the zone administrator enables the audit service for zone1 after taking the following actions are taken:

• The global zone administrator sets the perzone policy in the global zone.

• The zone administrator of the non-global zone configures the audit service and per-user customizations.

Then, the zone administrator enables the audit service for the zone.

zone1# audit -s