Auditing of the Network (nt) audit Class Can Cause System Failure (4172702)

When auditing is enabled, selecting for the network audit events (nt class) can cause the system to fail.

Workaround: Do not enable auditing for the network audit events (nt class) or all audit events (all class) for any user or for the default of all users. The Solaris 7 operating environment has neither of these classes enabled. Individual user audit is controlled in the /etc/security/audit_user file which has the form username:classes:classes. Do not enter either the class allor nt in either of the classes fields.

For example, do not modify an /etc/security/audit_user file with entries like

root:lo,nt:no 	
bill:all:no

dir:/var/audit
flags:nt
minfree:20
naflags:lo