To Create Dedicated Audit Partitions

During installation, the install team creates dedicated audit partition(s) when formatting the disks.

Use the naming convention /etc/security/audit/sytem_name(.n)

A diskfull computer should have at least one local audit directory, which it can use as a directory of last resort, if unable to communicate with the audit server.

See Audit Storage for an explanation of the naming convention.

On an audit file server, most partitions hold audit files, as is shown in the following example of the egret audit file server:

Another disk holds egret's / (root) and /swap partitions.

On a diskfull computer, including the audit administration server, at least one partition should be dedicated to local audit files, as is shown in the following example of the system willet:

Hints

A rule of thumb is to assign 200 MB of space for each system. However, the disk space requirements at your site will be based on how much auditing you perform and may be far greater than this figure.

Fewer and large partitions are more efficient than more and smaller ones.

To add a disk to hold audit partitions after installing the system, see the Solaris 8 System Administration Guide, Volume II. To protect the disks with Trusted Solaris security attributes, see Trusted Solaris Administrator's Procedures.