Enabling and Using Auditing

The Logical Domains Manager uses the Oracle Solaris OS auditing feature to examine the history of actions and events that have occurred on your control domain. The history is kept in a log of what was done, when it was done, by whom, and what was affected.

You can enable and disable the auditing feature based on the version of the Oracle Solaris OS that runs on your system, as follows:

• Oracle Solaris 10 OS. Use the bsmconv and bsmunconv commands. See the bsmconv(1M) and bsmunconv(1M) man pages, and Part VII, Auditing in Oracle Solaris, in System Administration Guide: Security Services.

• Oracle Solaris 11 OS. Use the audit command. See the audit(1M) man page and Part VII, Auditing in Oracle Solaris, in Oracle Solaris Administration: Security Services.

How to Enable Auditing

You must configure and enable the Oracle Solaris auditing feature on your system. The Oracle Solaris OS auditing feature is used to examine the history of actions and events that have occurred on your control domain. The history is kept in a log of what was done, when it was done, by whom, and what was affected. Oracle Solaris 11 auditing is enabled by default, but you must still perform some configuration steps.

1. Add customizations to the /etc/security/audit_event and /etc/security/audit_class files.

   These customizations are preserved across Oracle Solaris upgrades, but should be re-added after a fresh Oracle Solaris installation.

   1. Add the following entry to the audit_event file, if not already present:

      40700:AUE_ldoms:ldoms administration:vs

   2. Add the following entry to the audit_class file, if not already present:

      0x10000000:vs:virtualization_software

2. (Oracle Solaris 10) Add the vs class to the /etc/security/audit_control file.

   The following example /etc/security/audit_control fragment shows how you might specify the vs class:

   dir:/var/audit
   flags:lo,vs
   minfree:20
   naflags:lo,na

3. (Oracle Solaris 10) Enable the auditing feature.
   1. Run the bsmconv command.

      # /etc/security/bsmconv

   2. Reboot the system.
4. (Oracle Solaris 11) Preselect the vs audit class.
   1. Determine which auditing classes are already selected.

      Ensure that any audit classes that have already been selected are part of the updated set of classes. The following example shows that the lo class is already selected:

      # auditconfig -getflags
      active user default audit flags = lo(0x1000,0x1000)
      configured user default audit flags = lo(0x1000,0x1000)

   2. Add the vs auditing class.

      # auditconfig -setflags [class],vs

      class is zero or more audit classes, separated by commas. You can see the list of audit classes in the /etc/security/audit_class file. It is important to include the vs class on your Oracle VM Server for SPARC system.

      For example, the following command selects both the lo and vs classes:

      # auditconfig -setflags lo,vs

   3. (Optional) Log out of the system if you want to audit your processes, either as the administrator or as the configurer.

      If you do not want to log out, see How to Update the Preselection Mask of Logged In Users in Oracle Solaris Administration: Security Services.

5. Verify that the auditing software is running.

   # auditconfig -getcond

   If the auditing software is running, audit condition = auditing appears in the output.

How to Disable Auditing

• Disable the auditing feature.
  • Disable the auditing feature on your Oracle Solaris 10 system.
    1. Run the bsmunconv command.

       # /etc/security/bsmunconv
       Are you sure you want to continue? [y/n] y
       This script is used to disable the Basic Security Module (BSM).
       Shall we continue the reversion to a non-BSM system now? [y/n] y
       bsmunconv: INFO: removing c2audit:audit_load from /etc/system.
       bsmunconv: INFO: stopping the cron daemon.
       
       The Basic Security Module has been disabled.
       Reboot this system now to come up without BSM.

    2. Reboot the system.
  • Disable the auditing feature on your Oracle Solaris 11 system.
    1. Run the audit -t command.

       # audit -t

    2. Verify that the auditing software is no longer running.

       # auditconfig -getcond
       audit condition = noaudit

How to Review Audit Records

• Use one of the following to review vs audit output:
  • Use the auditreduce and praudit commands to review audit output.

    # auditreduce -c vs | praudit
    # auditreduce -c vs -a 20060502000000 | praudit

  • Use the praudit -x command to print audit records in XML form.

How to Rotate Audit Logs

• Use the audit -n command to rotate audit logs.

  Rotating the audit logs closes the current audit file and opens a new one in the current audit directory.