Audit plugins specify how to handle the audit records in the audit queue. The audit plugins are specified by name in the audit_control file: audit_binfile.so, audit_remote.so, and audit_syslog.so.The plugins and their parameters can specify the following:
Where to send binary data, by using the audit_binfile.so plugin, p_dir parameter
The minimum space remaining on a disk before the administrator is warned, by using the audit_binfile.so plugin, p_minfree parameter
The maximum size of an audit file, by using the audit_binfile.so plugin, p_fsize parameter
A selection of audit records to be sent to syslog, by using the audit_syslog.so plugin, p_flags parameter
The maximum number of audit records that are queued for the plugin, by using the qsize parameter
A remote authenticated audit server to send the binary audit data to, by using the audit_remote plugin
Refer to the audit_binfile(5), audit_remote(5), audit_syslog(5), and audit_control(4) man pages.