To configure the audit service, you typically use auditconfig subcommands. The configuration that is set with these subcommands applies to the whole system.
auditconfig -get* displays the current configuration of the parameter that is represented by the asterisk (*), as shown in the examples of Displaying Audit Service Defaults.
auditconfig -set* assigns a value to the parameter that is represented by the asterisk (*), such as –setflags, –setpolicy, or –setqctrl. To configure classes for non-attributable events, you use the auditconfig setnaflags subcommand.
auditconfig -conf configures kernel audit event to class mappings. Runtime class mappings are changed to match those in the audit event to class database file.