Audit Plugin Modules

You can specify audit plugin modules to handle the records that your preselection has placed in the audit queue. The plugins are entries in the audit_control file.

• audit_binfile.so plugin – Handles delivery of the audit queue to the binary audit files. In the audit_control file, if no plugin is specified and the dir entry has a value, then the audit daemon uses this plugin.

• audit_remote.so plugin – Handles secure delivery of binary audit records from the audit queue to a configured remote server. The audit_remote.so plugin uses the libgss() library to authenticate the server. The transmission is protected for privacy and integrity.

• audit_syslog.so plugin – Handles delivery of selected records from the audit queue to the syslog logs.

For the syntax of the audit_control file, see the audit_control(4) man page. For examples, see the tasks in Configuring Audit Files (Task Map).

For information about the plugins, see the audit_binfile(5), audit_syslog(5), audit_remote(5), and audit_control(4) man pages.