Solaris Audit Service

The Solaris audit service, auditd, is configured by using the following auditconfig subcommands:

• The -setpolicy subcommand modifies the audit policies.

• The -setqbufsz, -setqctrl, -setqdelay, -setqhiwater, and -setqlowater subcommands set audit queue parameters.

The auditconfig -t subcommand command creates a temporary, or active, value. Without the -t option, the values are persistent, or configured. For more information, see the auditconfig(1M) man page.

The bsmconv command enables the audit service initially. The service is stopped and restarted by using the audit -t and audit -s commands, respectively. The bsmunconv command disables the service permanently.

For more information, see the audit(1M), auditconfig(1M), and bsmconv(1M) man pages.