Managing Auditing in Oracle^® Solaris 11.4

How to Configure Per-Zone Auditing

This procedure enables separate zone administrators to control the audit service in their zone. For the complete list of policy options, see the auditconfig(8) man page.

Before You Begin

To configure auditing, you must become an administrator who is assigned the Audit Configuration rights profile. To enable the audit service, you must become an administrator who is assigned the Audit Control rights profile. For more information, see Using Your Assigned Administrative Rights in Securing Users and Processes in Oracle Solaris 11.4.

1. In the global zone, configure auditing.
   1. Complete the tasks in Configuring the Audit Service.
   2. Add the perzone audit policy.

      For the command, see Example 9, Setting the perzone Audit Policy.

      ---

      Note -  You are not required to enable the audit service in the global zone.

      ---

2. In each non-global zone that you plan to audit, configure the audit files.
   1. Complete the tasks in Configuring the Audit Service.
   2. Do not add the perzone or ahlt policy to the non-global zone.
3. Enable auditing in your zone.

   myzone$ pfexec audit -s

Example 17  Disabling Auditing in a Non-Global Zone

This example works if the perzone audit policy is set. The zone administrator of the noaudit zone disables auditing for that zone.

noauditzone$ pfexec auditconfig -getcond
audit condition = auditing
noauditzone$ pfexec audit -t
noauditzone$ pfexec auditconfig -getcond
audit condition = noaudit