As role secadmin, at label admin_low
, add audit classes in the audit_classes file.
Add the classes you planned in "Planning a Site-Specific Event-to-Class Mapping", write the file, and exit the editor.
Do not reassign the hexadecimal numbers already in use.
As role secadmin, at label admin_low
, open the Audit Events action to add the new class to each event in the new class.
For events in more than one class, use a comma (no space) to delimit the classes.
Write the file and exit the editor.
Make any changes to audit_control(4) and audit_user(4) to audit the events in the new classes.
See "To Set Audit Flags" and "To Set User Exceptions to the Audit Flags" for details of the procedures.
On a distributed system, the audit_class, audit_event, audit_startup, and audit_user files must be identical on every workstation on the network. See "To Distribute Audit Configuration Files to a Network of Workstations" for a process to distribute master copies of files to all workstations on the network.
Reboot, or as secadmin in an admin_low
profile shell, run the auditconfig(1M) command with appropriate options.
In the following example, the audit session ID is 159, and the new classes are gr(for graphic applications) and db (for databases applications).
$ auditconfig -setsmask 159 gr,db |