Audit Plugins

Audit plugins specify how to handle the audit records in the audit queue. The audit plugins are specified by name in the audit_control file: audit_binfile.so, audit_remote.so, and audit_syslog.so.The plugins and their parameters can specify the following:

• Where to send binary data, by using the audit_binfile.so plugin, p_dir parameter

• The minimum space remaining on a disk before the administrator is warned, by using the audit_binfile.so plugin, p_minfree parameter

• The maximum size of an audit file, by using the audit_binfile.so plugin, p_fsize parameter

• A selection of audit records to be sent to syslog, by using the audit_syslog.so plugin, p_flags parameter

• The maximum number of audit records that are queued for the plugin, by using the qsize parameter

• A remote authenticated audit server to send the binary audit data to, by using the audit_remote plugin

Refer to the audit_binfile(5), audit_remote(5), audit_syslog(5), and audit_control(4) man pages.