Auditing Header Token Contains Host Information

This feature is new in the Software Express pilot program. This feature is included in the Solaris 10 3/05 release.

The header token in audit records has been expanded to include the name of the host.

The old header is displayed as follows:

header,131,4,login - local,,Wed Dec 11 14:23:54 2002, + 471 msec

The new expanded header is displayed as follows:

header,162,4,login - local,,example-hostname,
Fri Mar 07 22:27:49 2003, + 770 msec

Customized scripts or tools that parse praudit output might need to be updated to reflect this change.

See Chapter 30, “Solaris Auditing (Reference)” and “header Token” in the System Administration Guide: Security Services for further information.