Enabling and Disabling the Audit Service (Tasks)

Auditing is a Service Management Facility (SMF) service. The service is configured by the auditconfig command and enabled by the audit -s command. If the perzone audit policy is set in the global zone, zone administrators can enable, refresh, and disable the service in their non-global zones.

How to Enable the Audit Service

This procedure enables the audit service for all zones. To start the audit service in a non-global zone, see Example 30-21.

Before You Begin

You must be assigned the Audit Control rights profile.

You can enable auditing after completing the following tasks:

• Planning – Planning Oracle Solaris Auditing (Task Map)

• Configuring – Configuring the Audit Service (Task Map)

• Setting audit policies – How to Change Audit Policy

• Configuring who receives audit warning messages – How to Configure the audit_warn Email Alias

• Configuring storage – Configuring Audit Logs

1. Use the audit -s command to enable the audit service.

   # audit -s

   For more information, see the audit(1M) and auditd(1M) man pages.

2. Verify that auditing is enabled.

   # auditconfig -getcond
   audit condition = auditing

Example 30-21 Enabling Auditing in a Non-Global Zone

In this example, the zone1 non-global zone is booted after the following actions are taken:

• The global zone administrator sets the perzone policy in the global zone and enables auditing.

• The zone administrator of the non-global zone configures the audit service and per-user exceptions.

Then, the zone administrator enables the audit service for the zone.

zone1# audit -s

How to Disable the Audit Service

This procedure shows how to disable auditing in the global zone and in a non-global zone when the perzone audit policy is set.

If the audit service is no longer required, this procedure returns the system to the system state before auditing was enabled.

• If the perzone audit policy is not set, auditing is disabled for all zones.

• If the perzone audit policy is set in the global zone, the policy remains in effect in the non-global zones that have enabled auditing.

  Because the perzone policy is set in the global zone, the non-global zone continues to collect audit records across global zone reboots and non-global zone reboots.

Before You Begin

You must be assigned the Audit Control rights profile.

• Run the audit -t command to disable the audit service.

  For more information, see the audit(1M) and auditd(1M) man pages.

  • In the global zone, disable the audit service.

    # audit -t

  • In a non-global zone, disable the audit service.

    If the perzone audit policy is set in the global zone, the non-global zone administrator disables the service in the non-global zone.

    zone1 # audit -t

How to Refresh the Audit Service

This procedure updates the audit service when you have made configuration changes after the audit service is enabled.

Before You Begin

You must be assigned the Audit Control rights profile.

1. Refresh the audit service.

   # audit -s

   You must run this command if you run the auditconfig -setplugin command.

   ---

   Note - When you refresh the audit service, all temporary configuration settings are lost. Audit policy and queue controls allow temporary settings. For more information, see the auditconfig(1M) man page.

   ---

2. Update the preselection masks of users who are currently being audited.

   Audit records are generated based on the audit preselection mask that is associated with each process. Refreshing the audit service does not change the masks of existing processes. To explicitly reset the preselection mask for an existing process, see How to Update a User's Preselection Mask.

Example 30-22 Refreshing an Enabled Audit Service

In this example, the administrator reconfigures auditing, verifies the changes, then refreshes the audit service.

• First, the administrator adds a temporary policy.

  # auditconfig -t -setpolicy +zonename
  # auditconfig -getpolicy
  configured audit policies = ahlt,arge,argv,perzone
  active audit policies = ahlt,arge,argv,perzone,zonename

• Then, the administrator specifies queue controls.

  # auditconfig -setqctrl 200 20 0 0
  # auditconfig -getqctrl
  configured audit queue hiwater mark (records) = 200
  configured audit queue lowater mark (records) = 20
  configured audit queue buffer size (bytes) = 8192
  configured audit queue delay (ticks) = 20
  active audit queue hiwater mark (records) = 200
  active audit queue lowater mark (records) = 20
  active audit queue buffer size (bytes) = 8192
  active audit queue delay (ticks) = 20

• Then, the administrator specifies plugin attributes.

  • For the audit_binfile plugin, the administrator removes the qsize value.

    # auditconfig -getplugin audit_binfile
    Plugin: audit_binfile (active)
        Attributes: p_dir=/audit/example1/files,/var/audit;
        p_minfree=2;p_fsize=3072000;
    Queue size: 200 
    # auditconfig -setplugin audit_binfile active "" ""
    # auditconfig -getplugin audit_binfile
    Plugin: audit_binfile (active)
        Attributes: p_dir=/audit/example1/files,/var/audit
     p_minfree=2;p_fsize=3072000;

  • For the audit_syslog plugin, the administrator specifies that successful login and logout events and failed executables be sent to syslog. The qsize for this plugin is set to 50.

    # auditconfig -setplugin audit_syslog active p_flags=+lo,-ex 50
    # auditconfig -getplugin audit_syslog
    auditconfig -getplugin audit_syslog
    Plugin: audit_syslog (active)
        Attributes: p_flags=+lo,-ex;
        Queue size: 50

  • The administrator does not configure or use the audit_remote plugin.

• Then, the administrator refreshes the audit service and verifies the configuration.

  • The temporary zonename policy is no longer set.

    # audit -s
    # auditconfig -getpolicy
    configured audit policies = ahlt,arge,argv,perzone
    active audit policies = ahlt,arge,argv,perzone

  • The queue controls remain the same.

    # auditconfig -getqctrl
    configured audit queue hiwater mark (records) = 200
    configured audit queue lowater mark (records) = 20
    configured audit queue buffer size (bytes) = 8192
    configured audit queue delay (ticks) = 20
    active audit queue hiwater mark (records) = 200
    active audit queue lowater mark (records) = 20
    active audit queue buffer size (bytes) = 8192
    active audit queue delay (ticks) = 20

  • The audit_binfile plugin does not have a specified queue size. The audit_syslog plugin has a specified queue size.

    # auditconfig -getplugin
    Plugin: audit_binfile (active)
        Attributes: p_dir=/var/audit;p_fsize=3072000;p_minfree=2;
    
    Plugin: audit_syslog (active)
        Attributes: p_flags=+lo,-ex;
        Queue size: 50 
    ...