Go to main content

Managing Auditing in Oracle® Solaris 11.4

Exit Print View

Updated: February 2019

How to Configure syslog for the audit_syslog Plugin

You can instruct the audit service to copy some or all of the audit records in the audit queue to the syslog utility. If you record both binary audit data and text summaries, the binary data provide a complete audit record, while the summaries filter the data for real-time review.

Before You Begin

To configure the audit_syslog plugin, you must become an administrator who is assigned the Audit Configuration rights profile. To configure the syslog utility and create the auditlog file, you must assume the root role.

  1. Select audit classes to be sent to the audit_syslog plugin, and make the plugin active.

    Note -  p_flags audit classes must be preselected as either system defaults or in the audit flags of a user or a rights profile. Records are not collected for a class that is not preselected.
    $ auditconfig -setplugin audit_syslog \
         active p_flags=lo,+as,-ss
  2. Configure the syslog utility.
    1. Add an audit.notice entry to the syslog.conf file that includes the location of the log file.
      # cat /etc/syslog.conf
      audit.notice       /var/adm/auditlog
    2. Create the log file.
      # touch /var/adm/auditlog
    3. Set the log file's permissions to 640.
      # chmod 640 /var/adm/auditlog
    4. Check which system-log service instance is running on the system.
      # svcs system-log
      STATE        STIME      FMRI
      online       13:14:36  	svc:/system/system-log:default
      disabled     13:13:36   svc:/system/system-log:rsyslog

      Note -  The default system log daemon is syslog.
    5. Refresh the configuration information for the active syslog service instance.
      # svcadm refresh system/system-log:default
  3. Refresh the audit service.

    The audit service reads the changes to the audit plugin upon refresh.

    # audit -s
  4. Regularly archive the syslog log files.

    The audit service can generate extensive output. To manage the logs, see the logadm(8) and syslog.conf(5) man pages>.

Example 24  Specifying Audit Classes for syslog Output

In this example, the syslog utility collects a subset of the preselected audit classes. The pf class is created in Example 11, Creating a New Audit Class.

$ auditconfig -setnaflags lo,na

$ auditconfig -setflags lo,ss

# usermod -K audit_flags=pf:no jdoe

$ auditconfig -setplugin audit_syslog \
    active p_flags=lo,+na,-ss,+pf

The arguments to the auditconfig command instruct the system to collect all login/logout, non-attributable, and change of system state audit records. The audit_syslog plugin entry instructs the syslog utility to collect all logins, successful non-attributable events, and failed changes of system state.

For the jdoe user, the binary utility collects successful and failed calls to the pfexec command. The syslog utility collects successful calls to the pfexec command.

Example 25  Putting syslog Audit Records on a Remote System

You can change the audit.notice entry in the syslog.conf file to point to a remote system. In this example, the name of the local system is sys1.1. The remote system is remote1.

sys1.1 # cat /etc/syslog.conf

audit.notice       @remote1

The audit.notice entry in the syslog.conf file on the remote1 system points to the log file.

remote1 # cat /etc/syslog.conf

audit.notice       /var/adm/auditlog