Go to main content

Managing Auditing in Oracle® Solaris 11.3

Exit Print View

Updated: December 2018
 
 

Auditing on a System With Oracle Solaris Zones

A zone is a virtualized operating system environment that is created within a single instance of the Oracle Solaris OS. The audit service audits the entire system, including activities in zones. A system that has installed non-global zones can run a single audit service in the global zones to audit all zones identically. Or, it can run one audit service per non-global zone, including an audit service for the global zone. These audit services would be administered separately.

    Sites can run a single audit service in the global zone when:

  • The site requires a single-image audit trail.

  • The non-global zones are used as application containers. The zones are part of one administrative domain. That is, no non-global zone has customized naming service files.

    If all the zones on a system are within one administrative domain, the zonename audit policy can be used to distinguish audit events that are configured in different zones.

  • Administrators want low audit overhead. The global zone administrator audits all zones identically. Also, the global zone's audit daemon serves all zones on the system.

    Sites can run one audit service per non-global zone when:

  • The site does not require a single-image audit trail.

  • The non-global zones have customized naming service files. These separate administrative domains typically function as network servers.

  • Individual zone administrators want to control auditing in the zones that they administer. In per-zone auditing, zone administrators can decide to enable or to disable auditing for the zone that they administer.

The advantages of per-zone auditing are a customized audit trail for each zone, and the ability to disable auditing on a zone-by-zone basis. These advantages can be offset by the administrative overhead. Each zone administrator must administer auditing. Each zone runs its own audit daemon, and has its own audit queue and audit logs. These audit logs must be managed.