System Administration Guide: Security Services

Audit Flags

Audit flags indicate classes of events to audit. Machine-wide defaults for auditing are specified for all users on each machine by flags in the audit_control file, which is described in The audit_control File.

You can modify what is audited for individual users by putting audit flags in a user's entry in the audit_user file. The audit flags are also used as arguments to the auditconfig command (see the auditconfig(1M) man page).

Definitions of Audit Flags

The following table shows each predefined audit class with the audit flag (which is the short name that stands for the class), the long name, and a short description. You use these audit flags in the auditing configuration files to specify which classes of events to audit. You can define new classes and rename existing classes by modifying the audit_class file (see the audit_class(4) man page).

Table 25–2 Audit Flags


Short Name	Long Name	Short Description
`no`	`no_class`	Null value for turning off event preselection
`fr`	`file_read`	Read of data, open for reading
`fw`	`file_write`	Write of data, open for writing
`fa`	`file_attr_acc`	Access of object attributes: `stat`, `pathconf`
`fm`	`file_attr_mod`	Change of object attributes: `chown`, `flock`
`fc`	`file_creation`	Creation of object
`fd`	`file_deletion`	Deletion of object
`cl`	`file_close`	`close` system call
`pc`	`process`	Process operations: `fork`, `exec`, `exit`
`nt`	`network`	Network events: `bind`, `connect`, `accept`
`ip`	`ipc`	System V IPC operations
`na`	`non_attrib`	Nonattributable events
`ad`	`administrative`	Administrative actions
`lo`	`login_logout`	Login and logout events
`ap`	`application`	Application-defined event
`io`	`ioctl`	`ioctl` system call
`ex`	`exec`	Program execution
`ot`	`other`	Miscellaneous
`all`	`all`	All flags set

Audit Flag Syntax

The prefixes determine whether a class of events is audited whether it succeeds or fails, or only if it succeeds, or only if it fails. Here is the format of the audit flag:

prefixflag

The following table shows prefixes that specify whether the audit class is audited for success or failure, or both.

Table 25–3 Prefixes Used in Audit Flags


Prefix	Definition
`none`	Audit for both success and failure
`+`	Audit for success only
`-`	Audit for failure only

For example, the audit flag lo (without any prefix) means that auditing should occur for “all successful attempts to log in and log out, and all failed attempts to log in.” You cannot fail an attempt to log out. As another example, the -all flag means that auditing should occur only for all failed attempts of any kind. The +all flag means that auditing should only occur for all successful attempts of any kind.

Caution –

The -all flag can generate large amounts of data and fill up audit file systems quickly. Use the -all flag only if you have extraordinary reasons to audit all activities.

Prefixes to Modify Audit Flags

Use the following prefixes in any of three ways:

In the flags line in the audit_control file to modify already specified flags
In flags field in the user's entry in the audit_user file
With arguments to the auditconfig command

See the auditconfig(1M) man page.

The prefixes in the following table, along with the short names of audit classes, turn on or turn off previously specified audit classes.

Table 25–4 Prefixes Used to Modify Already-Specified Audit Flags


Prefix	Definition
`^-`	Turn off for failed attempts
`^+`	Turn off for successful attempts
`^`	Turn off for both failed and successful attempts

The ^- prefix is used in the flags line in the following example from an audit_control file.

In the following example, the lo and ad flags specify that all logins and administrative operations are to be audited when they succeed and when they fail. The -all means audit “all failed events.” Because the ^- prefix means “turn off auditing for the specified class for failed attempts,” the ^-fc flag modifies the previous flag that specified the auditing of all failed events. The two fields together mean: “audit all failed events, except for failed attempts to create file system objects.”

flags:lo,ad,-all,^-fc