How to Add an Audit Class

When you create your own audit class, you can place into it just those audit events that you want to audit for your site. When you add the class on one system, you should copy the change to all systems that are being audited.

1. Assume the Primary Administrator role, or become superuser.

   The Primary Administrator role includes the Primary Administrator profile. To create the role and assign the role to a user, see Chapter 2, Working With the Solaris Management Console (Tasks), in System Administration Guide: Basic Administration.

2. (Optional) Save a backup copy of the audit_class file.

   # cp /etc/security/audit_class /etc/security/audit_class.orig

3. Add new entries to the audit_class file.

   Each entry has the following format:

   0xnumber:name:description

   0x

   Identifies number as hexadecimal.

   number

   Defines the unique audit class mask.

   name

   Defines the letter name of the audit class.

   description

   Defines the descriptive name of the audit class.

   The entry must be unique in the file. Do not use existing audit class masks.

Example 30–10 Creating a New Audit Class

This example creates a class to hold a small set of audit events. The added entry to the audit_class file is as follows:

0x10000000:pf:profile command

The entry creates a new audit class that is called pf. Example 30–11 populates the new audit class.

Troubleshooting

If you have customized the audit_class file, make sure that any modifications to audit_user are consistent with the new audit classes. Errors occur when the audit classes in audit_user are not a subset of the audit_class database.