As a system administrator, you need to monitor system activity. You need to be aware of all aspects of your machines, including the following:
What is the normal load?
Who has access to the system?
When do individuals access the system?
What programs normally run on the system?
With this kind of knowledge, you can use the available tools to audit system use and monitor the activities of individual users. Monitoring is very useful when a breach in security is suspected. For more information about the audit service, see Chapter 1, About Auditing in Oracle Solaris, in Managing Auditing in Oracle Solaris 11.2 .