The audit plugin modules direct the audit records from the audit queue to a file or repository. At least one plugin must be active. By default, the audit_binfile plugin is active. You configure plugins with the auditconfig -setplugin plugin-name command.
The audit service provides the following plugins:
audit_binfile plugin – Handles delivery of the audit queue to the binary audit files. For more information, see the audit.log(4) man page.
audit_remote plugin – Handles secure delivery of binary audit records from the audit queue to a configured remote server. The audit_remote plugin uses the libgss() library to authenticate the server. The transmission is protected for privacy and integrity.
audit_syslog plugin – Handles delivery of selected records from the audit queue to the syslog logs.
For information about how to configure a plugin, see the auditconfig (1M) man page. For examples of plugin configuration, see the tasks in Configuring Audit Logs. For information about the plugins, see the audit_binfile (5) , audit_remote (5) , and audit_syslog (5) man pages.