Index
Numbers and Symbols
- + (plus sign) in audit class prefixes
- - (minus sign)
- audit class prefix
Audit Class Syntax
- audit class prefix
- [] (square brackets)
- auditrecord outputAudit Record Analysis
- auditrecord output
- ^ (caret)
- audit class prefix modifierAudit Class Syntax
- in audit class prefixesHow to Configure a User's Audit Characteristics
- audit class prefix modifier
A
- ACLs
- setting audit entriesSetting Audit ACL Entries
- (example of)Setting Audit ACL Entries
- (example of)
- setting audit entries
- active audit policy
- temporary audit policyHow to Change Audit Policy
- temporary audit policy
- adding
- audit classesHow to Add an Audit Class
- audit file systemsHow to Create ZFS File Systems for Audit Files
- audit policyHow to Change Audit Policy
- auditing
- of zonesConcepts in Planning Auditing
- of zones
- plugins
- temporary audit policySetting a Temporary Audit Policy
- audit classes
- admhist command
- administering auditing
- audit -s command
- audit -t commandEnabling and Disabling the Audit Service
- audit classesAudit Classes and Preselection
- audit eventsAudit Events
- audit filesViewing the Contents of Binary Audit Files
- audit recordsAudit Records and Audit Tokens
- audit trail overflow preventionPreventing Audit Trail Overflow
- audit_remote plugin
- audit_syslog pluginHow to Configure syslog for the
audit_syslog Plugin
- auditconfig command
- auditreduce commandHow to Merge Audit Files From the Audit Trail
- configuringConfiguring the Audit Service
- cost controlControlling Auditing Costs
- descriptionFlow of Auditing
- efficiencyAuditing Efficiently
- in zones
- plugins
- praudit commandViewing the Contents of Binary Audit Files
- reducing space requirementsCost of Storage of Audit Data
- rights profiles requiredRights Profiles for Administering Auditing
- ahlt audit policy
- descriptionEffects of Audit Policy Options
- with cnt policyAudit Policies for Asynchronous and Synchronous Events
- description
- all audit class
- caution for usingAudit Classes
- caution for using
- always-audit classes
- process preselection maskProcess Audit Characteristics
- process preselection mask
- Analytics
- auditing data andNew Feature – Displaying Auditing Data Graphically
- auditing data and
- annotationsNew Feature – Annotating Reason for Access in the Audit
Record
- configuring
- for authenticated rights profilesConfiguring Annotation for Specific Users
- for rights profilesConfiguring Annotation for Specific Users
- for specific usersConfiguring Annotation for Specific Users
- for authenticated rights profiles
- configuring for all usersConfiguring Annotation for All Users
- PAM supportPAM Supports Annotation of Logins
- tracking in an audit trailTracking Annotations in an Audit Trail
- configuring
- archiving
- audit filesPreventing Audit Trail Overflow
- audit files
- arge audit policy
- descriptionEffects of Audit Policy Options
- description
- argv audit policy
- descriptionEffects of Audit Policy Options
- description
- ARS
- asynchronous audit eventsAudit Policies for Asynchronous and Synchronous Events
- audit -s command
- audit -t commandEnabling and Disabling the Audit Service
- audit characteristics
- audit user IDProcess Audit Characteristics
- processesProcess Audit Characteristics
- session IDProcess Audit Characteristics
- terminal IDProcess Audit Characteristics
- user process preselection maskProcess Audit Characteristics
- audit user ID
- audit classes
- configurationAudit Classes
- description
- displaying configuredNew Feature – Listing the Available Audit Classes
- displaying defaultsDisplaying Audit Service Defaults
- exceptions to system-wide settingsAudit Classes and Preselection
- mapping eventsAudit Classes and Preselection
- modifying defaultHow to Add an Audit Class
- overviewAudit Classes and Preselection
- pe audit classNew Feature – Per-Privilege Logging of Audit Events
- per-plugin configurationNew Feature – Flexible Per-Plugin Configuration of Audit
Classes
- post-selectionAudit Terminology and Concepts
- prefixesAudit Class Syntax
- preselecting
- effect on public objectsAudit Terminology and Concepts
- for failure
- for success
- for success and failureHow to Preselect Audit Classes
- effect on public objects
- preselectionAudit Terminology and Concepts
- process preselection maskProcess Audit Characteristics
- replacingHow to Preselect Audit Classes
- sstore
- user exceptionsHow to Configure a User's Audit Characteristics
- configuration
- Audit Configuration rights profile
- Rights Profiles for Administering Auditing
- How to Audit All Commands by Users
- How to Add an Audit Class
- How to Change Audit Policy
- How to Preselect Audit Classes
- New Feature – Refreshing the auditset SMF
Service After Changing Event-Class Mappings
- displaying auditing defaultsDisplaying Audit Service Defaults
- Audit Control rights profile
- Rights Profiles for Administering Auditing
- How to Compress Audit Files on a Dedicated File System
- Enabling and Disabling the Audit Service
- refreshing audit serviceExample: Configuring Oracle Solaris Auditing
- audit directory
- creating file systems forHow to Create ZFS File Systems for Audit Files
- creating file systems for
- audit event-to-class mappings
- audit events
- attributableAudit Events
- audit_event file andAudit Events
- changing class membershipHow to Change an Audit Event's Class Membership
- descriptionAudit Events
- logging
- mapping to classesAudit Classes and Preselection
- non-attributableAudit Events
- removing from audit_event fileHow to Prevent the Auditing of Specific Events
- selecting from audit trailSelecting Audit Events to Be Displayed
- selecting from audit trail in zonesAuditing and Oracle Solaris Zones
- selecting multiple eventsNew Feature – Reviewing Multiple Audit Events
- verified boot impactNew Feature – Auditing Verified Boot
- viewing from binary filesViewing the Contents of Binary Audit Files
- attributable
- audit file system
- descriptionAudit Terminology and Concepts
- description
- audit files
- compressing on diskHow to Compress Audit Files on a Dedicated File System
- copying messages to single fileMerging Selected Records to a Single File
- creating summary files
- effects of Coordinated Universal Time (UTC)How to Merge Audit Files From the Audit Trail
- limiting size ofBinary Audit File Sizes Grow Without Limit
- managingPreventing Audit Trail Overflow
- printingPrinting the Entire Audit Trail
- reading with prauditViewing the Contents of Binary Audit Files
- reducing size ofHow to Merge Audit Files From the Audit Trail
- reducing space requirementsCost of Storage of Audit Data
- reducing storage-space requirementsAuditing Efficiently
- setting aside disk space forHow to Create ZFS File Systems for Audit Files
- time stampsConventions for Binary Audit File Names
- compressing on disk
- audit flags
- setting and displayingNew Feature – Auditing Events Temporarily
- summary ofAudit Terminology and Concepts
- setting and displaying
- audit logs See Alsoaudit files
- comparing binary and text summariesAudit Logs
- configuringConfiguring Local Audit Logs
- configuring text summary audit logsHow to Configure syslog for the
audit_syslog Plugin
- modesAudit Logs
- comparing binary and text summaries
- audit plugins
- audit_binfile pluginConfiguring Audit Space for the Audit Trail and Audit Files
- audit_remote plugin
- audit_syslog pluginHow to Configure syslog for the
audit_syslog Plugin
- descriptionAudit Terminology and Concepts
- summary of
- audit_binfile plugin
- audit policy
- audit tokens fromAudit Policy
- defaultsUnderstanding Audit Policy
- descriptionAudit Terminology and Concepts
- displaying defaultsDisplaying Audit Service Defaults
- effects ofUnderstanding Audit Policy
- settingHow to Change Audit Policy
- setting ahltSetting the ahlt Audit Policy Option
- setting argeHow to Audit All Commands by Users
- setting argvHow to Audit All Commands by Users
- setting in global zone
- setting perzoneSetting the perzone Audit Policy
- that does not affect tokensAudit Policy
- tokens added byAudit Policy
- audit tokens from
- audit preselection mask
- modifying for existing usersHow to Update the Preselection Mask of Logged In Users
- modifying for individual usersHow to Configure a User's Audit Characteristics
- modifying for existing users
- audit queue
- events includedAudit Classes and Preselection
- events included
- audit queue controls
- displaying defaultsDisplaying Audit Service Defaults
- displaying defaults
- audit records
- /var/adm/auditlog fileHow to Configure syslog for the
audit_syslog Plugin
- adding annotationsNew Feature – Annotating Reason for Access in the Audit
Record
- converting to readable formatViewing a Specific Audit File
- copying to single fileMerging Selected Records to a Single File
- descriptionAudit Terminology and Concepts
- displaying definitions of
- procedureDisplaying Audit Record Definitions
- procedure
- displaying formats of a programDisplaying the Audit Record Definitions of a Program
- displaying formats of an audit classDisplaying the Audit Record Definitions of an Audit Class
- displaying in XML formatPutting Audit Records in XML Format
- displaying summary of successful privileged execution records
- events that generateHow Does Auditing Work?
- formatAudit Record Structure
- formatting exampleDisplaying Audit Record Definitions
- overviewAudit Records and Audit Tokens
- policies that add tokens toAudit Policy
- reducing audit file sizeHow to Merge Audit Files From the Audit Trail
- sequence of tokensAudit Record Structure
- /var/adm/auditlog file
- audit remote server
- description ofAudit Remote Server
- managingManaging the Audit Remote Server
- sending files toHow to Send Audit Files to a Remote Repository
- description of
- Audit Review rights profile
- audit service See Alsoauditing
- administrative audit eventsHow to Audit Significant Events in Addition to Login/Logout
- audit trail creationAudit Trail
- auditing privileged usersHow to Audit Significant Events in Addition to Login/Logout
- configuring policyHow to Change Audit Policy
- cusa audit classHow to Audit Significant Events in Addition to Login/Logout
- defaultsAudit Service
- refreshing the kernelExample: Configuring Oracle Solaris Auditing
- significant event auditingHow to Audit Significant Events in Addition to Login/Logout
- troubleshootingAudit Records Are Not Being Logged
- administrative audit events
- audit session ID
- definitionProcess Audit Characteristics
- overviewWhat Is Auditing?
- definition
- audit tokens See Alsoindividual audit token names
- added by audit policyAudit Policy
- audit record formatAudit Record Structure
- formatAudit Token Formats
- added by audit policy
- audit trail
- adding disk spaceConfiguring Audit Space for the Audit Trail and Audit Files
- analysis costsCost of Analysis of Audit Data
- cleaning up not_terminated filesHow to Clean Up a not_terminated Audit File
- creating summary files
- descriptionAudit Terminology and Concepts
- effect of audit policyUnderstanding Audit Policy
- including annotationsNew Feature – Annotating Reason for Access in the Audit
Record
- monitoring in real timeAuditing Efficiently
- overviewFlow of Auditing
- preventing overflowPreventing Audit Trail Overflow
- reducing size of
- restricting access using labelsNew Feature – Restricting Access to Audit Records With File
Labeling
- selecting events fromSelecting Audit Events to Be Displayed
- sending files to remote repository
- tracking annotationsTracking Annotations in an Audit Trail
- viewing events fromViewing the Contents of Binary Audit Files
- viewing events from different zonesAuditing and Oracle Solaris Zones
- adding disk space
- audit user ID
- mechanismProcess Audit Characteristics
- overviewWhat Is Auditing?
- mechanism
- audit.notice entry
- syslog.conf fileHow to Configure syslog for the
audit_syslog Plugin
- syslog.conf file
- audit command
- disabling audit serviceEnabling and Disabling the Audit Service
- optionsAudit Service Man Pages
- refreshing audit serviceExample: Configuring Oracle Solaris Auditing
- disabling audit service
- audit_binfile pluginAudit Plugin Modules
- getting attributes
- limiting audit file sizeLimiting File Size for the audit_binfile Plugin
- setting attributesConfiguring Audit Space for the Audit Trail and Audit Files
- setting free space warningSetting a Soft Limit for Warnings
- specifying time for log rotationSpecifying Time for Log Rotation
- audit_class file
- adding a classHow to Add an Audit Class
- troubleshootingCreating a New Audit Class
- adding a class
- audit_event file
- changing class membershipHow to Change an Audit Event's Class Membership
- descriptionAudit Events
- removing events safelyHow to Prevent the Auditing of Specific Events
- changing class membership
- audit_flags keyword
- How to Audit Significant Events in Addition to Login/Logout
- How to Configure a User's Audit Characteristics
- specifying user exceptions to audit preselectionHow to Configure a User's Audit Characteristics
- using caret (^) prefixModifying Audit Preselection Exception for One User
- audit_remote pluginAudit Plugin Modules
- getting attributes
- setting attributes
- troubleshooting audit queue overfullTuning the Audit Queue Buffer Size
- audit_syslog pluginAudit Plugin Modules
- setting attributesHow to Configure syslog for the
audit_syslog Plugin
- setting attributes
- audit_warn script
- configuringHow to Configure the audit_warn Email
Alias
- descriptionAudit Service Man Pages
- configuring
- auditconfig command
- adding audit file systemsConfiguring Audit Space for the Audit Trail and Audit Files
- audit classes as argumentsAudit Classes and Preselection
- configuring policyHow to Change Audit Policy
- descriptionAudit Service Man Pages
- displaying audit defaultsDisplaying Audit Service Defaults
- –getplugin option
- –lsclass optionNew Feature – Listing the Available Audit Classes
- –lsevent optionNew Feature – Listing Audit Events by Audit Class
- policy optionsHow to Change Audit Policy
- preselecting audit classesHow to Preselect Audit Classes
- sending files to remote repository
- –setflags optionHow to Preselect Audit Classes
- –setnaflags optionHow to Preselect Audit Classes
- –setplugin option
- setting active audit policySetting a Temporary Audit Policy
- setting audit policyHow to Audit All Commands by Users
- setting audit policy temporarilySetting a Temporary Audit Policy
- setting audit_binfile attributesConfiguring Audit Space for the Audit Trail and Audit Files
- setting audit_remote attributes
- setting system-wide audit parametersAudit Classes and Preselection
- viewing default audit preselectionHow to Preselect Audit Classes
- adding audit file systems
- auditd daemon
- refreshing audit serviceExample: Configuring Oracle Solaris Auditing
- refreshing audit service
- auditing
- adding audit flags to a group of usersCreating a Rights Profile for a Group of Users
- all commands by usersHow to Audit All Commands by Users
- audit remote serverManaging the Audit Remote Server
- auditors' perspectiveBest Practices for Auditing Core System Files
- changes in current releaseWhat's New in the Audit Service in Oracle Solaris 11.4
- configuring
- all zonesConfiguring the Audit Service
- global zoneSetting the ahlt Audit Policy Option
- identically for all zonesHow to Configure All Zones Identically for Auditing
- all zones
- configuring in global zoneImplementing One Audit Service for All Zones
- crontab editingS failurecrontab File Editing Fails With Audit Context Error
- crontab filescrontab File Editing Fails With Audit Context Error
- customizingSelecting What Is Audited
- default configurationDefault Configuration of the Audit Service
- defaultsAudit Service
- determining if runningAudit Records Are Not Being Logged
- finding changes to specific filesHow to Find Audit Records of Changes to Specific Files
- local definitionAudit Terminology and Concepts
- man page summariesAudit Service Man Pages
- planningConcepts in Planning Auditing
- planning in zonesPlanning Auditing in Zones
- plugin modulesAudit Plugin Modules
- plugin to Oracle Audit Vault and Database FirewallUsing Oracle Audit Vault and Database Firewall for Storage and Analysis of Audit Records
- post-selection definitionAudit Terminology and Concepts
- preselection definitionAudit Terminology and Concepts
- remote definitionAudit Terminology and Concepts
- rights profiles forRights Profiles for Administering Auditing
- sftp file transfersHow to Audit FTP and SFTP File Transfers
- troubleshootingTroubleshooting the Audit Service
- troubleshooting praudit commandProcessing praudit Output With a Script
- updating information
- adding audit flags to a group of users
- auditlog file
- text audit recordsHow to Configure syslog for the
audit_syslog Plugin
- text audit records
- auditrecord command
- [] (square brackets) in outputAudit Record Analysis
- checking verified boot settingsNew Feature – Auditing Verified Boot
- descriptionAudit Service Man Pages
- displaying audit record definitionsDisplaying Audit Record Definitions
- listing all formatsDisplaying Audit Record Definitions
- listing formats of classDisplaying the Audit Record Definitions of an Audit Class
- listing formats of programDisplaying the Audit Record Definitions of a Program
- optional tokens ([])Audit Record Analysis
- [] (square brackets) in output
- auditreduce command
- auditing verified boot eventsNew Feature – Auditing Verified Boot
- –b optionCombining and Reducing Audit Files
- cleaning up audit filesHow to Clean Up a not_terminated Audit File
- descriptionAudit Service Man Pages
- filtering optionsSelecting Audit Events to Be Displayed
- merging audit recordsHow to Merge Audit Files From the Audit Trail
- –O option
- selecting annotationsTracking Annotations in an Audit Trail
- selecting audit recordsSelecting Audit Events to Be Displayed
- time stamp useHow to Merge Audit Files From the Audit Trail
- using lowercase optionsSelecting Audit Events to Be Displayed
- using uppercase optionsHow to Merge Audit Files From the Audit Trail
- auditing verified boot events
- auditstat command
- descriptionAudit Service Man Pages
- description
- auid Seeimmutable audit user ID
B
- binary and remote recordsAbout Binary Records
C
- caret (^)
- in audit class prefixesHow to Configure a User's Audit Characteristics
- using prefix in audit_flags valueModifying Audit Preselection Exception for One User
- in audit class prefixes
- changing
- audit_class fileHow to Add an Audit Class
- audit_event fileHow to Change an Audit Event's Class Membership
- auditing defaultsHow to Preselect Audit Classes
- audit_class file
- classes Seeaudit classes
- cleaning up
- binary audit filesHow to Clean Up a not_terminated Audit File
- binary audit files
- cnt audit policy
- descriptionEffects of Audit Policy Options
- with ahlt policyAudit Policies for Asynchronous and Synchronous Events
- description
- combining audit files
- auditreduce commandHow to Merge Audit Files From the Audit Trail
- from different zonesAuditing and Oracle Solaris Zones
- auditreduce command
- compressing
- audit files on diskHow to Compress Audit Files on a Dedicated File System
- audit files on disk
- configuration decisions
- auditing
- file storagePlanning Disk Space for Audit Records
- remote file storagePreparing to Stream Audit Records to Remote Storage
- who and what to auditHow to Plan Who and What to Audit
- file storage
- auditing
- configuration files
- auditingAudit Service Man Pages
- auditing
- configured audit policy
- permanent audit policyHow to Change Audit Policy
- permanent audit policy
- configuring
- active audit policySetting a Temporary Audit Policy
- ahlt audit policySetting the ahlt Audit Policy Option
- audit policyHow to Change Audit Policy
- audit classesHow to Preselect Audit Classes
- audit logs task mapConfiguring the audit_binfile and
audit_syslog Plugins
- audit policyHow to Change Audit Policy
- audit policy temporarilySetting a Temporary Audit Policy
- audit trail overflow preventionPreventing Audit Trail Overflow
- audit_class fileHow to Add an Audit Class
- audit_event fileHow to Change an Audit Event's Class Membership
- audit_warn scriptHow to Configure the audit_warn Email
Alias
- auditingConfiguring the Audit Service
- auditing reportsUsing Oracle Audit Vault and Database Firewall for Storage and Analysis of Audit Records
- auditing task mapConfiguring the Audit Service
- identical auditing for non-global zonesHow to Configure All Zones Identically for Auditing
- per-zone auditingHow to Configure Per-Zone Auditing
- perzone audit policySetting the perzone Audit Policy
- space for audit trailConfiguring Audit Space for the Audit Trail and Audit Files
- text summaries of audit recordsHow to Configure syslog for the
audit_syslog Plugin
- active audit policy
- converting
- audit records to readable formatViewing a Specific Audit File
- audit records to readable format
- Coordinated Universal Time (UTC)
- time stamp use in auditing
- copying audit records to single fileMerging Selected Records to a Single File
- core files
- auditing changes toBest Practices for Auditing Core System Files
- auditing changes to
- cost control
- and auditingControlling Auditing Costs
- and auditing
- creating
- audit trailAudit Trail
- rights profile for a group of usersCreating a Rights Profile for a Group of Users
- storage for binary audit filesHow to Create ZFS File Systems for Audit Files
- audit trail
- cusa audit class
D
- defaults
- audit serviceAudit Service
- audit service
- deleting
- archived audit filesPreventing Audit Trail Overflow
- not_terminated audit filesHow to Clean Up a not_terminated Audit File
- archived audit files
- determining
- audit ID of a userHow to Update the Preselection Mask of Logged In Users
- whether auditing is runningAudit Records Are Not Being Logged
- audit ID of a user
- disabling
- audit policyHow to Change Audit Policy
- audit serviceEnabling and Disabling the Audit Service
- audit policy
- disk space requirements
- displaying
- audit events for specified audit flagsNew Feature – Listing Audit Events by Audit Class
- audit policiesHow to Change Audit Policy
- audit policy defaultsDisplaying Audit Service Defaults
- audit queue controlsDisplaying Audit Service Defaults
- audit record definitionsDisplaying Audit Record Definitions
- audit recordsViewing the Contents of Binary Audit Files
- audit records in XML formatPutting Audit Records in XML Format
- auditing defaultsDisplaying Audit Service Defaults
- definition of audit recordsDisplaying Audit Record Definitions
- exceptions to system-wide auditingDisplaying Audit Service Defaults
- selected audit recordsHow to Merge Audit Files From the Audit Trail
- audit events for specified audit flags
E
- /etc/security/audit_event file
- audit events andAudit Events
- audit events and
- /etc/syslog.conf file
- efficiency
- auditing andAuditing Efficiently
- auditing and
- enabling
- audit serviceEnabling and Disabling the Audit Service
- audit service
- environment variables
- presence in audit recordsEffects of Audit Policy Options
- presence in audit records
- event
- descriptionAudit Events
- description
- events
- auditing significantHow to Audit Significant Events in Addition to Login/Logout
- cusa audit classHow to Audit Significant Events in Addition to Login/Logout
- auditing significant
F
- failure and success events
- audit class prefixAudit Class Syntax
- audit class prefix
- file transfers
- files See Alsoaudit files
- audit_classAudit Service Man Pages
- audit_eventAudit Service Man Pages
- auditing modifications toHow to Find Audit Records of Changes to Specific Files
- public objectsAudit Terminology and Concepts
- specifying files to be audited
- audit_class
- filtering audit records Seeaudit tags
- flags line
- process preselection maskProcess Audit Characteristics
- process preselection mask
- format of audit records
- auditrecord commandDisplaying Audit Record Definitions
- auditrecord command
- ftp command
- logging file transfersHow to Audit FTP and SFTP File Transfers
- logging file transfers
G
- group audit policy
- and group tokenEffects of Audit Policy Options
- descriptionEffects of Audit Policy Options
- and group token
H
- hard disk
- space requirements for auditingCost of Storage of Audit Data
- space requirements for auditing
I
- IDs
- audit
- mechanismProcess Audit Characteristics
- overviewWhat Is Auditing?
- mechanism
- audit sessionProcess Audit Characteristics
- audit
- immutable audit user ID
- Seeaudit user ID
- Seeaudit user ID
- See
K
- keywords
L
- labeled_only audit policy
- and label tokenEffects of Audit Policy Options
- descriptionEffects of Audit Policy Options
- and label token
- labeling
- use to restrict access to audit trailNew Feature – Restricting Access to Audit Records With File
Labeling
- use to restrict access to audit trail
- limiting
- audit file sizeBinary Audit File Sizes Grow Without Limit
- audit file size
- local auditingAudit Terminology and Concepts
- log files
- /var/adm/messagesTroubleshooting the Audit Service
- /var/log/syslogTroubleshooting the Audit Service
- audit records
- configuring for audit serviceHow to Configure syslog for the
audit_syslog Plugin
- /var/adm/messages
- logadm command
- archiving text summary audit filesPreventing Audit Trail Overflow
- archiving text summary audit files
- logging
- audit events
- ftp file transfersHow to Audit FTP and SFTP File Transfers
- logging in
- auditing loginsLogins From Other Operating Systems Not Being Audited
- auditing logins
- logins
- audited for annotationPAM Supports Annotation of Logins
- PAM support of annotationPAM Supports Annotation of Logins
- audited for annotation
M
- Mail Management rights profileHow to Configure the audit_warn Email
Alias
- man pages
- audit serviceAudit Service Man Pages
- audit service
- managing
- audit records task mapManaging Audit Records on Local Systems
- audit trail overflowPreventing Audit Trail Overflow
- audit records task map
- mappings
- events to classes (auditing)Audit Classes and Preselection
- events to classes (auditing)
- mask (auditing)
- description of process preselectionProcess Audit Characteristics
- description of process preselection
- merging
- binary audit recordsHow to Merge Audit Files From the Audit Trail
- binary audit records
- minus sign (-)
- audit class prefixAudit Class Syntax
- audit class prefix
- modifying
- user security attributesHow to Configure a User's Audit Characteristics
- user security attributes
- monitoring
- audit trail in real timeAuditing Efficiently
- audit trail in real time
N
- naming conventions
- audit filesConventions for Binary Audit File Names
- audit files
- never-audit classes
- process preselection maskProcess Audit Characteristics
- process preselection mask
- new features
- auditing enhancementsWhat's New in the Audit Service in Oracle Solaris 11.4
- auditing enhancements
- newaliases commandHow to Configure the audit_warn Email
Alias
O
- Oracle Audit Vault and Database Firewall
- overflow prevention
- audit trailPreventing Audit Trail Overflow
- audit trail
P
- –p_flags option Seeauditconfig command
- path audit policy
- descriptionEffects of Audit Policy Options
- description
- pe audit class Seeprivileged execution audit class
- permanent audit policy
- configured audit policyHow to Change Audit Policy
- configured audit policy
- perzone audit policy
- descriptionEffects of Audit Policy Options
- using
- description
- planning
- auditingConcepts in Planning Auditing
- auditing in zonesPlanning Auditing in Zones
- auditing
- plugins
- auditingAudit Plugin Modules
- auditing
- plus sign (+) in audit class prefixes
- policies
- for auditingUnderstanding Audit Policy
- that add tokens to audit recordsAudit Policy
- for auditing
- policy
- audited commandsHow to Audit Significant Events in Addition to Login/Logout
- audited commands
- policy.conf file
- configuring annotationsConfiguring Annotation for All Users
- configuring annotations
- post-selection in auditingAudit Terminology and Concepts
- praudit command
- converting audit records to readable formatViewing a Specific Audit File
- descriptionAudit Service Man Pages
- piping auditreduce output toPrinting the Entire Audit Trail
- using in a scriptProcessing praudit Output With a Script
- viewing audit recordsViewing the Contents of Binary Audit Files
- XML formatPutting Audit Records in XML Format
- converting audit records to readable format
- prefixes for audit classesAudit Class Syntax
- preselecting
- audit classesHow to Preselect Audit Classes
- audit classes
- preselection in auditingAudit Terminology and Concepts
- preselection mask (auditing)
- descriptionProcess Audit Characteristics
- description
- preventing audit trail overflowPreventing Audit Trail Overflow
- printing
- audit logPrinting the Entire Audit Trail
- audit log
- privileged execution audit classNew Feature – Per-Privilege Logging of Audit Events
- process audit characteristics
- audit session IDProcess Audit Characteristics
- audit user IDProcess Audit Characteristics
- process preselection maskProcess Audit Characteristics
- terminal IDProcess Audit Characteristics
- audit session ID
- process preselection mask
- descriptionProcess Audit Characteristics
- description
- processing time costs of audit serviceCost of Increased Processing Time of Audit Data
- profiles
- adding annotationsConfiguring Annotation for Specific Users
- adding annotations
- public directories
- auditingAudit Terminology and Concepts
- auditing
- public objects
- auditingAudit Terminology and Concepts
- auditing
- public audit policy
- descriptionEffects of Audit Policy Options
- read-only eventsEffects of Audit Policy Options
- description
R
- readable audit record format
- converting audit records toViewing a Specific Audit File
- converting audit records to
- reducing
- audit file sizeHow to Merge Audit Files From the Audit Trail
- disk space required for audit filesHow to Compress Audit Files on a Dedicated File System
- storage-space requirements for audit filesAuditing Efficiently
- audit file size
- refreshing audit serviceExample: Configuring Oracle Solaris Auditing
- remote auditingAudit Terminology and Concepts
- removing
- audit events from audit_event fileHow to Prevent the Auditing of Specific Events
- audit events from audit_event file
- replacing preselected audit classesHow to Preselect Audit Classes
- rights
- audit profilesRights Profiles for Administering Auditing
- audit profiles
- Rights Delegation rights profileHow to Audit All Commands by Users
- rights profiles
- Audit Configuration
- audit service andRights Profiles for Administering Auditing
- Mail ManagementHow to Configure the audit_warn Email
Alias
- Rights DelegationHow to Audit All Commands by Users
- Service Configuration
- ZFS File System ManagementHow to Compress Audit Files on a Dedicated File System
- ZFS Storage ManagementHow to Compress Audit Files on a Dedicated File System
- roleadd command
- adding annotationsConfiguring Annotation for Specific Users
- adding annotations
- rolemod command
- adding annotationsConfiguring Annotation for Specific Users
- adding annotations
- root role
- crontabauditing error messagecrontab File Editing Fails With Audit Context Error
- crontabauditing error message
S
- scripts
- audit_warn script
- monitoring audit files exampleAuditing Efficiently
- processing praudit outputProcessing praudit Output With a Script
- security
- selecting
- actions to be auditedSelecting What Is Audited
- audit classesHow to Preselect Audit Classes
- audit recordsSelecting Audit Events to Be Displayed
- events from audit trailSelecting Audit Events to Be Displayed
- actions to be audited
- seq audit policy
- and sequence tokenEffects of Audit Policy Options
- descriptionEffects of Audit Policy Options
- and sequence token
- Service Configuration rights profile
- Session Annotations Seeannotations
- session ID
- setting
- ACL audit entriesSetting Audit ACL Entries
- (example of)Setting Audit ACL Entries
- (example of)
- arge policyHow to Audit All Commands by Users
- argv policyHow to Audit All Commands by Users
- audit policyHow to Change Audit Policy
- ACL audit entries
- sftp command
- auditing file transfersHow to Audit FTP and SFTP File Transfers
- auditing file transfers
- site security policies
- size of audit files
- reducing storage-space requirementsAuditing Efficiently
- reducing storage-space requirements
- SMF
- auditd serviceAudit Service
- auditd service
- square brackets ([])
- auditrecord outputAudit Record Analysis
- auditrecord output
- sstore meta-class
- starting auditingEnabling and Disabling the Audit Service
- StatsStore
- contains auditing dataNew Feature – Displaying Auditing Data Graphically
- contains auditing data
- storage costs and auditingCost of Storage of Audit Data
- storage overflow prevention
- audit trailPreventing Audit Trail Overflow
- audit trail
- storing
- audit files remotelyPreparing to Stream Audit Records to Remote Storage
- audit files remotely
- success and failure events
- audit class prefixAudit Class Syntax
- audit class prefix
- svcadm command
- syslog.conf file
- audit.notice levelHow to Configure syslog for the
audit_syslog Plugin
- audit.notice level
- syslog recordsAbout syslog Audit Records
T
- tail command
- example of useAuditing Efficiently
- example of use
- task maps
- configuring audit logsConfiguring the audit_binfile and
audit_syslog Plugins
- configuring auditingConfiguring the Audit Service
- managing audit recordsManaging Audit Records on Local Systems
- planning auditingConcepts in Planning Auditing
- configuring audit logs
- temporary audit policy
- active audit policyHow to Change Audit Policy
- active audit policy
- terminal ID
- time stamps
- audit filesConventions for Binary Audit File Names
- audit files
- trail audit policy
- and trailer tokenEffects of Audit Policy Options
- descriptionEffects of Audit Policy Options
- and trailer token
- troubleshooting
- active pluginNo Audit Plugin Active
- audit classes
- praudit commandProcessing praudit Output With a Script
- too many audit records in queueTuning the Audit Queue Buffer Size
- active plugin
U
- UDP
- using for remote audit logsAudit Logs
- using for remote audit logs
- user ID
- audit ID andProcess Audit Characteristics
- audit ID and
- user ID and audit IDWhat Is Auditing?
- user_attr database
- adding annotationsConfiguring Annotation for Specific Users
- listing user exceptions to audit preselectionHow to Configure a User's Audit Characteristics
- adding annotations
- user_attr file
- exceptions to system-wide audit classesAudit Classes and Preselection
- exceptions to system-wide audit classes
- useradd command
- adding annotationsConfiguring Annotation for Specific Users
- adding annotations
- useradm command
- adding annotationsConfiguring Annotation for Specific Users
- adding annotations
- userattr command
- displaying exceptions to system-wide auditingDisplaying Audit Service Defaults
- displaying exceptions to system-wide auditing
- usermod command
- adding annotationsConfiguring Annotation for Specific Users
- audit_flags keywordHow to Configure a User's Audit Characteristics
- exceptions to system-wide auditingAudit Classes and Preselection
- specifying user exceptions to audit preselectionHow to Configure a User's Audit Characteristics
- using caret (^) prefix for audit_flags exceptionModifying Audit Preselection Exception for One User
- adding annotations
- users
- auditing all commandsHow to Audit All Commands by Users
- auditing privilegedHow to Audit Significant Events in Addition to Login/Logout
- creating rights profile for a groupCreating a Rights Profile for a Group of Users
- modifying audit preselection mask ofHow to Configure a User's Audit Characteristics
- auditing all commands
V
- /var/adm/auditlog file
- text audit recordsHow to Configure syslog for the
audit_syslog Plugin
- text audit records
- /var/adm/messages file
- troubleshooting auditingTroubleshooting the Audit Service
- troubleshooting auditing
- /var/log/syslog file
- troubleshooting auditingTroubleshooting the Audit Service
- troubleshooting auditing
- variables
- adding to audit recordEffects of Audit Policy Options
- adding to audit record
- verified boot
- auditing impact ofNew Feature – Auditing Verified Boot
- auditing impact of
- viewing
- audit record definitionsDisplaying Audit Record Definitions
- binary audit filesViewing the Contents of Binary Audit Files
- XML audit recordsPutting Audit Records in XML Format
- audit record definitions
X
- XML format
- audit recordsPutting Audit Records in XML Format
- audit records
Z
- ZFS File System Management rights profileHow to Compress Audit Files on a Dedicated File System
- creating audit file systemsHow to Create ZFS File Systems for Audit Files
- creating audit file systems
- ZFS file systems
- creating for binary audit filesHow to Create ZFS File Systems for Audit Files
- creating for binary audit files
- ZFS Storage Management rights profileHow to Compress Audit Files on a Dedicated File System
- creating pools for audit filesHow to Create ZFS File Systems for Audit Files
- creating pools for audit files
- zonename audit policy
- descriptionEffects of Audit Policy Options
- description
- zones
- configuring auditing in global zoneSetting the ahlt Audit Policy Option
- perzone audit policy
- planning auditing inPlanning Auditing in Zones
- zonename audit policy
- configuring auditing in global zone