How to Compress Audit Files on a Dedicated File System

Audit files can grow large. You can set an upper limit to the size of a file, as shown in Example 4–3. In this procedure, you use compression to reduce the size.

Before You Begin

You must become an administrator who is assigned the ZFS File System Management and ZFS Storage Management rights profiles. The latter profile enables you to create storage pools. For more information, see Using Your Assigned Administrative Rights in Securing Users and Processes in Oracle Solaris 11.2.

1. Dedicate a ZFS file system for audit files.

   For the procedure, see How to Create ZFS File Systems for Audit Files.

2. Compress the ZFS storage pool by using one of the following options.

   With both options, the audit file system is compressed. After the audit service is refreshed, the compression ratio is displayed.

   In the following examples, the ZFS pool auditp/auditf is the dataset.

   • Use the default compression algorithm.

     # zfs set compression=on auditp/auditf
     # audit -s
     # zfs get compressratio auditp/auditf
     NAME           PROPERTY       VALUE  SOURCE
     auditp/auditf  compressratio  4.54x  -

   • Use a higher compression algorithm.

     # zfs set compression=gzip-9 auditp/auditf
     # zfs get compression auditp/auditf
     NAME           PROPERTY     VALUE     SOURCE
     auditp/auditf  compression  gzip-9    local
     

     The gzip-9 compression algorithm results in files that occupy one-third less space than the default compression algorithm, lzjb. For more information, see Chapter 5, Managing Oracle Solaris ZFS File Systems, in Managing ZFS File Systems in Oracle Solaris 11.2 .

3. Refresh the audit service.

   # audit -s

4. (Optional) Verify the new compression setting.

   For example, if you used the higher compression algorithm, the information would be similar to the following:

   # zfs get compressration auditp/auditf
   NAME           PROPERTY       VALUE  SOURCE
   auditp/auditf  compressratio  16.89x  -