Audit plugins specify how to handle the audit records in the audit queue. The audit plugins are specified by name: audit_binfile, audit_remote, and audit_syslog, as arguments to the auditconfig -setplugin command. The plugins can be further specified by the following attributes:
audit_binfile plugin
p_dir attribute – Where to send binary data
p_minfree attribute – Minimum space remaining on a disk before the administrator is warned.
p_fsize attribute – Maximum size of an audit file.
audit_remote plugin
p_hosts attribute– Remote authenticated audit server to which to send the binary audit data.
p_retries attribute – Number of attempts to make to reach a remote authenticated audit server.
p_timeout attribute – Number of seconds between attempts to reach a remote authenticated audit server.
audit_syslog plugin
p_flags attribute – Selection of text summaries of audit records to be sent to syslog
For all plugins, the maximum number of audit records that are queued for the plugin ??? qsize attribute
Refer to the audit_binfile(5), audit_remote(5), audit_syslog(5), and auditconfig(1M) man pages.