The following are factors to consider when changing the contents of default audit classes and creating new ones in the Trusted Solaris environment.
This document, Trusted Solaris Audit Administration, reports the default auditing configuration.
Document your site's modifications to the auditing defaults, and make the document available to the administrators handling audit administration.
If you are networked, you must change the auditing configuration files on all the workstations when you change the files on one workstation.
A network of Trusted Solaris workstations behaves like one workstation. When auditing is enabled, it is enabled on every workstation, and every workstation is audited for the same classes, has the same defaults, has the same user exceptions, and has the same event-to-class mappings as every other Trusted Solaris workstation in the network.