Changes to Auditing

The Solaris 8 HW 7/03 release introduced changes to the audit_class file and to the audit_event file. The Trusted Solaris 8 HW 7/03 release includes those changes. Backward compatibility with a site's existing user configuration is maintained. In addition, audit trails from previous Trusted Solaris releases can still be processed.

The audit_class file has changed in the following ways:

• Some classes have been assigned to a new mask value.

• Some administrative classes have been changed.

• Some administrative classes have been added.

• The obsolete fn and io classes have been removed.

The audit_event file has changed in the following ways:

• Some events have been assigned to a new class. The new assignments correspond to the audit_class changes that are described in the preceding list.

• Several obsolete events have been changed to the no class.

For details of the changes, see the audit_class file and the audit_event file on your system.