How to Enable Logical Domains Manager Auditing

Although Oracle Solaris 11 auditing is enabled by default, you must configure Logical Domains Manager auditing.

1. Add customizations to the /etc/security/audit_event and /etc/security/audit_class files.

   These customizations are preserved across Oracle Solaris upgrades, but should be re-added after a fresh Oracle Solaris installation.

   1. Add the following entry to the audit_event file if not already present:

      40700:AUE_ldoms:ldoms administration:vs

   2. Add the following entry to the audit_class file if not already present:

      0x10000000:vs:virtualization_software

2. Preselect the vs audit class.
   1. Determine which auditing classes are already selected.

      Ensure that any audit classes that have already been selected are part of the updated set of classes. The following example shows that the lo class is already selected:

      # auditconfig -getflags
      active user default audit flags = lo(0x1000,0x1000)
      configured user default audit flags = lo(0x1000,0x1000)

   2. Add the vs auditing class.

      # auditconfig -setflags [class],vs

      class is zero or more audit classes, separated by commas. You can see the list of audit classes in the /etc/security/audit_class file. Be sure to include the vs class on your Oracle VM Server for SPARC system.

      For example, the following command selects both the lo and vs classes:

      # auditconfig -setflags lo,vs

   3. (Optional) Log out of the system if you want to audit your processes, either as the administrator or as the configurer.

      If you do not want to log out, see How to Update the Preselection Mask of Logged In Users in Managing Auditing in Oracle Solaris 11.3 .

3. Verify that Oracle Solaris OS auditing is enabled.

   # auditconfig -getcond

   If the auditing software is running, audit condition = auditing appears in the output.

4. Configure Logical Domains Manager to generate audit records.
   1. Set the ldmd/audit SMF property value to true.

      # svccfg -s ldmd setprop ldmd/audit = boolean: true

   2. Refresh the ldmd service.

      # svcadm refresh ldmd

   3. Restart the ldmd service.

      # svcadm restart ldmd