ナビゲーションリンクをスキップ | |
印刷ビューの終了 | |
![]() |
マニュアルページセクション 1M: システム管理コマンド Oracle Solaris 11 Information Library (日本語) |
- audit daemon warning script
/etc/security/audit_warn [option [arguments]]
The audit_warn utility processes warning or error messages from the audit daemon. When a problem is encountered, the audit daemon, auditd(1M) calls audit_warn with the appropriate arguments. The option argument specifies the error type.
The system administrator can specify a list of mail recipients to be notified when an audit_warn situation arises by defining a mail alias called audit_warn in aliases(4). The users that make up the audit_warn alias are typically the audit and root users.
The following options are supported:
Indicates that the hard limit for all filesystems has been exceeded count times. The default action for this option is to send mail to the audit_warn alias only if the count is 1, and to write a message to the machine console every time. It is recommended that mail not be sent every time as this could result in a the saturation of the file system that contains the mail spool directory.
Indicates that the soft limit for all filesystems has been exceeded. The default action for this option is to send mail to the audit_warn alias and to write a message to the machine console.
Indicates that someone other than the audit daemon changed the system audit state to something other than AUC_AUDITING. The audit daemon will have exited in this case. The default action for this option is to send mail to the audit_warn alias and to write a message to the machine console.
Indicates that the audit daemon is already running. The default action for this option is to send mail to the audit_warn alias and to write a message to the machine console.
Indicates that the hard limit for the file has been exceeded. The default action for this option is to send mail to the audit_warn alias and to write a message to the machine console.
Indicates that the audit service could not find an IP address to associate with the local hostname. It has fallen back to using the “loopback” address. The audit trail might not translate properly. See /var/audit/debug for more information. The audit service can be refreshed (audit -s) to retry to find an IP address.
Indicates that auditing could not be started. The default action for this option is to send mail to the audit_warn alias and to write a message to the machine console. Some administrators may prefer to modify audit_warn to reboot the system when this error occurs.
Indicates that an error occurred during execution of the auditd plugin name. The default action for this option is to send mail to the audit_warn alias only if count is 1, and to write a message to the machine console every time. (Separate counts are kept for each error type.) It is recommended that mail not be sent every time as this could result in the saturation of the file system that contains the mail spool directory. The text field provides the detailed error message passed from the plug-in. The error field is one of the following strings:
Unable to load the plugin name.
The plugin name is not executing due to a system error such as a lack of resources.
No plug-ins loaded (including the binary file plug-in, audit_binfile(5)) due to configuration errors (see the -setplugin option of the auditconfig(1M) command). The name string is -- , to indicate that no plug-in name applies.
The plugin name reports it has encountered a temporary failure. For example, the audit_binfree.so plugin uses retry to indicate that all directories are full.
The plugin name reports a failure due to lack of memory.
The plugin name reports it received an invalid input.
The plugin name has reported an error as described in text.
Indicates that an error occurred during the orderly shutdown of the audit daemon. The default action for this option is to send mail to the audit_warn alias and to write a message to the machine console.
Indicates that the soft limit for filename has been exceeded. The default action for this option is to send mail to the audit_warn alias and to write a message to the machine console.
Indicates that the temporary audit file already exists indicating a fatal error. The default action for this option is to send mail to the audit_warn alias and to write a message to the machine console.
See attributes(5) for descriptions of the following attributes:
|
The interface stability is Evolving. The file content is Unstable.
audit(1M), auditconfig(1M), auditd(1M), aliases(4), audit.log(4), attributes(5)
See the section on Solaris Auditing in 『Oracle Solaris の管理: セキュリティーサービス』.
This functionality is available only if the Solaris Auditing feature has been enabled.
If the audit policy perzone is set, the /etc/security/audit_warn script for the local zone is used for notifications from the local zone's instance of auditd. If the perzone policy is not set, all auditd errors are generated by the global zone's copy of /etc/security/audit_warn.