Audit plugins specify how to handle the audit records in the audit queue. The audit plugins are specified by name: audit_binfile, audit_remote, and audit_syslog, as arguments to the auditconfig -setplugin command. The plugins can be further specified by the following attributes:
audit_binfile plugin
p_dir attribute – Where to send binary data
p_minfree attribute – Minimum space remaining on a disk before the administrator is warned.
p_fsize attribute – Maximum size of an audit file.
audit_remote plugin
p_hosts attribute– Remote authenticated audit server to which to send the binary audit data.
p_retries attribute – Number of attempts to make to reach a remote authenticated audit server.
p_timeout attribute – Number of seconds between attempts to reach a remote authenticated audit server.
audit_syslog plugin
p_flags attribute – Selection of text summaries of audit records to be sent to syslog
For all plugins, the maximum number of audit records that are queued for the plugin ‐ qsize attribute
Refer to the audit_binfile(5), audit_remote(5), audit_syslog(5), and auditconfig(1M) man pages.