To Enable Auditing

By default, auditing is enabled. If you have disabled auditing, enable it by reversing the above procedure.

1. As role secadmin, at label admin_low, open the script /etc/init.d/audit using the Admin Editor.

2. Remove the comments from the audit start script:

   …
   # Start the audit daemon
   	if [ -f /etc/security/audit_startup ] ; then
   			echo ”starting audit daemon”
   			/etc/security/audit_startup
   			/usr/sbin/auditd &
   	fi
   …
   

3. Write and quit the file.

4. Enable the audit daemon to exit gracefully at shutdown by removing the comments in the stop script in /etc/init.d/audit:

   …
   # Stop the audit daemon
   	if [ -f /etc/security/audit_startup ] ; then
   		/usr/sbin/audit -t
   		fi

5. Write and quit the file.

6. Open the script /etc/init.d/drvconfig using the Admin Editor.

7. Comment out the Disable auditing lines:

   # Disable auditing
   #
   # /usr/bin/adb -wk /dev/ksyms /dev/mem > /dev/null <<end
   # audit_active/W 0
   # end

8. Write and quit the file.

9. For the changes to take effect, reboot using the Shut Down menu item from the TP (Trusted Path) menu.