Index
Numbers and Symbols
- + (plus sign) in audit class prefixes
- - (minus sign)
- audit class prefix
Audit Class Syntax
- audit class prefix
- [] (square brackets)
- auditrecord outputAudit Record Analysis
- auditrecord output
- ^ (caret)
- audit class prefix modifierAudit Class Syntax
- in audit class prefixesHow to Configure a User's Audit Characteristics
- audit class prefix modifier
A
- acl audit token
- formatacl Token
- format
- active audit policy
- temporary audit policyHow to Change Audit Policy
- temporary audit policy
- adding
- audit classes
- audit file systemsHow to Create ZFS File Systems for Audit Files
- audit policyHow to Change Audit Policy
- auditing
- of zonesConcepts in Planning Auditing
- of zones
- plugins
- temporary audit policySetting a Temporary Audit Policy
- administering auditing
- audit -s command
- audit -t commandEnabling and Disabling the Audit Service
- audit classesAudit Classes and Preselection
- audit eventsAudit Events
- audit filesViewing the Contents of Binary Audit Files
- audit recordsAudit Records and Audit Tokens
- audit trail overflow preventionPreventing Audit Trail Overflow
- audit_remote plugin
- audit_syslog pluginHow to Configure syslog Audit Logs
- auditconfig command
- auditreduce commandHow to Merge Audit Files From the Audit Trail
- configuringConfiguring the Audit Service
- cost controlControlling Auditing Costs
- descriptionFlow of Auditing
- efficiencyAuditing Efficiently
- in zones
- plugins
- praudit commandViewing the Contents of Binary Audit Files
- queue controlsHow to Change Audit Queue Controls
- reducing space requirementsCost of Storage of Audit Data
- rights profiles requiredRights Profiles for Administering
Auditing
- ahlt audit policy
- descriptionEffects of Audit Policy Options
- with cnt policyAudit Policies for Asynchronous and Synchronous Events
- description
- all audit class
- caution for usingAudit Classes
- caution for using
- always-audit classes
- process preselection maskProcess Audit Characteristics
- process preselection mask
- archiving
- audit filesPreventing Audit Trail Overflow
- audit files
- arge audit policy
- and exec_env tokenexec_env Token
- descriptionEffects of Audit Policy Options
- and exec_env token
- argument audit token
- formatargument Token
- format
- argv audit policy
- and exec_args tokenexec_args Token
- descriptionEffects of Audit Policy Options
- and exec_args token
- ARS
- asynchronous audit eventsAudit Policies for Asynchronous and Synchronous Events
- attribute audit tokenattribute Token
- audit -s command
- audit -t commandEnabling and Disabling the Audit Service
- audit characteristics
- audit user IDProcess Audit Characteristics
- processesProcess Audit Characteristics
- session IDProcess Audit Characteristics
- terminal IDProcess Audit Characteristics
- user process preselection maskProcess Audit Characteristics
- audit user ID
- audit classes
- configurationAudit Classes
- description
- displaying defaultsDisplaying Audit Service Defaults
- exceptions to system-wide settingsAudit Classes and Preselection
- mapping eventsAudit Classes and Preselection
- modifying defaultHow to Add an Audit Class
- overviewAudit Classes and Preselection
- post-selectionAudit Terminology and Concepts
- prefixesAudit Class Syntax
- preselecting
- effect on public objectsAudit Terminology and Concepts
- for failure
- for success
- for success and failureHow to Preselect Audit Classes
- effect on public objects
- preselectionAudit Terminology and Concepts
- process preselection maskProcess Audit Characteristics
- replacingHow to Preselect Audit Classes
- syntaxAudit Class Syntax
- user exceptionsHow to Configure a User's Audit Characteristics
- configuration
- Audit Configuration rights profileRights Profiles for Administering
Auditing
- configuring audit policyHow to Change Audit Policy
- displaying auditing defaultsDisplaying Audit Service Defaults
- preselecting audit classesHow to Preselect Audit Classes
- configuring audit policy
- Audit Control rights profileRights Profiles for Administering
Auditing
- disabling audit serviceEnabling and Disabling the Audit Service
- enabling audit serviceEnabling and Disabling the Audit Service
- refreshing audit serviceExample: Configuring Oracle Solaris Auditing
- disabling audit service
- audit directory
- creating file systems forHow to Create ZFS File Systems for Audit Files
- creating file systems for
- audit event-to-class mappings
- audit events
- audit_event file andAudit Events
- changing class membershipHow to Change an Audit Event's Class Membership
- descriptionAudit Events
- mapping to classesAudit Classes and Preselection
- removing from audit_event fileHow to Prevent the Auditing of Specific Events
- selecting from audit trailSelecting Audit Events to Be Displayed
- selecting from audit trail in zonesAuditing and Oracle Solaris Zones
- viewing from binary filesViewing the Contents of Binary Audit Files
- audit_event file and
- audit file system
- descriptionAudit Terminology and Concepts
- description
- audit files
- compressing on diskHow to Compress Audit Files on a Dedicated File System
- copying messages to single fileMerging Selected Records to a Single File
- creating summary files
- effects of Coordinated Universal Time (UTC)How to Merge Audit Files From the Audit Trail
- limiting size ofBinary Audit File Sizes Grow Without Limit
- managingPreventing Audit Trail Overflow
- printingPrinting the Entire Audit Trail
- reading with prauditViewing the Contents of Binary Audit Files
- reducing size ofHow to Merge Audit Files From the Audit Trail
- reducing space requirementsCost of Storage of Audit Data
- reducing storage-space requirementsAuditing Efficiently
- setting aside disk space forHow to Create ZFS File Systems for Audit Files
- time stampsConventions for Binary Audit File
Names
- compressing on disk
- audit flags
- summary ofAudit Terminology and Concepts
- summary of
- audit logs See Alsoaudit files
- comparing binary and text summariesAudit Logs
- configuringConfiguring Local Audit Logs
- configuring text summary audit logsHow to Configure syslog Audit Logs
- modesAudit Logs
- comparing binary and text summaries
- audit plugins
- audit_binfile plugin
- audit_remote plugin
- audit_syslog pluginHow to Configure syslog Audit Logs
- descriptionAudit Terminology and Concepts
- qsize attributeHow to Change Audit Queue Controls
- summary of
- audit policy
- audit tokens fromAudit Policy
- defaultsUnderstanding Audit Policy
- descriptionAudit Terminology and Concepts
- displaying defaultsDisplaying Audit Service Defaults
- effects ofUnderstanding Audit Policy
- settingHow to Change Audit Policy
- setting ahltSetting the ahlt Audit Policy Option
- setting argeHow to Audit All Commands by Users
- setting argvHow to Audit All Commands by Users
- setting in global zone
- setting perzoneSetting the perzone Audit Policy
- that does not affect tokensAudit Policy
- tokens added byAudit Policy
- audit tokens from
- audit preselection mask
- modifying for existing usersHow to Update the Preselection Mask of Logged In Users
- modifying for individual usersHow to Configure a User's Audit Characteristics
- modifying for existing users
- audit queue
- events includedAudit Classes and Preselection
- events included
- audit queue controls
- displaying defaultsDisplaying Audit Service Defaults
- displaying defaults
- audit records
- /var/adm/auditlog fileHow to Configure syslog Audit Logs
- converting to readable formatViewing a Specific Audit File
- copying to single fileMerging Selected Records to a Single File
- descriptionAudit Terminology and Concepts
- displaying definitions of
- procedureDisplaying Audit Record Definitions
- procedure
- displaying formats of a programDisplaying the Audit Record Definitions of a Program
- displaying formats of an audit classDisplaying the Audit Record Definitions of an Audit Class
- displaying in XML formatPutting Audit Records in XML Format
- event modifiersheader Token
- events that generateHow Does Auditing Work?
- formatAudit Record Structure
- formatting exampleDisplaying Audit Record Definitions
- overviewAudit Records and Audit Tokens
- policies that add tokens toAudit Policy
- reducing audit file sizeHow to Merge Audit Files From the Audit Trail
- sequence of tokensAudit Record Structure
- /var/adm/auditlog file
- audit remote server
- managingManaging a Remote Repository
- overviewAudit Remote Server
- summary ofAudit Remote Server
- managing
- Audit Review rights profileRights Profiles for Administering
Auditing
- audit service See Alsoauditing
- audit trail creationAudit Trail
- configuring policyHow to Change Audit Policy
- configuring queue controlsHow to Change Audit Queue Controls
- defaultsAudit Service
- refreshing the kernelExample: Configuring Oracle Solaris Auditing
- troubleshootingAudit Records Are Not Being Logged
- audit trail creation
- audit session IDProcess Audit Characteristics
- overviewWhat Is Auditing?
- overview
- audit tokens See Alsoindividual audit token names
- added by audit policyAudit Policy
- audit record formatAudit Record Structure
- formatAudit Token Formats
- list ofAudit Token Formats
- xclient tokenxclient Token
- added by audit policy
- audit trail
- adding disk spaceHow to Assign Audit Space for the Audit Trail
- analysis costsCost of Analysis of Audit Data
- cleaning up not_terminated filesHow to Clean Up a not_terminated Audit File
- creating summary files
- descriptionAudit Terminology and Concepts
- effect of audit policyUnderstanding Audit Policy
- monitoring in real timeAuditing Efficiently
- overviewFlow of Auditing
- preventing overflowPreventing Audit Trail Overflow
- reducing size of
- selecting events fromSelecting Audit Events to Be Displayed
- sending files to remote repository
- viewing events fromViewing the Contents of Binary Audit Files
- viewing events from different zonesAuditing and Oracle Solaris Zones
- adding disk space
- audit user ID
- mechanismProcess Audit Characteristics
- overviewWhat Is Auditing?
- mechanism
- audit.notice entry
- syslog.conf fileHow to Configure syslog Audit Logs
- syslog.conf file
- audit command
- disabling audit serviceEnabling and Disabling the Audit Service
- optionsAudit Service Man Pages
- refreshing audit serviceExample: Configuring Oracle Solaris Auditing
- disabling audit service
- audit_binfile pluginAudit Plugin Modules
- getting attributes
- limiting audit file sizeLimiting File Size for the audit_binfile Plugin
- removing queue sizeRemoving Queue Size for an Audit Plugin
- setting attributesHow to Assign Audit Space for the Audit Trail
- setting free space warningSetting a Soft Limit for Warnings
- specifying time for log rotationSpecifying Time for Log Rotation
- audit_class file
- adding a classHow to Add an Audit Class
- troubleshootingCreating a New Audit Class
- adding a class
- audit_event file
- changing class membershipHow to Change an Audit Event's Class Membership
- descriptionAudit Events
- removing events safelyHow to Prevent the Auditing of Specific Events
- changing class membership
- audit_flags keywordHow to Configure a User's Audit Characteristics
- specifying user exceptions to audit preselectionHow to Configure a User's Audit Characteristics
- using caret (^) prefixModifying Audit Preselection Exception for One User
- specifying user exceptions to audit preselection
- audit_remote pluginAudit Plugin Modules
- getting attributes
- setting attributes
- troubleshooting audit queue overfullTuning the Audit Queue Buffer Size
- audit_syslog pluginAudit Plugin Modules
- setting attributesHow to Configure syslog Audit Logs
- setting attributes
- audit_warn script
- configuringHow to Configure the audit_warn Email Alias
- descriptionAudit Service Man Pages
- configuring
- auditconfig command
- adding audit file systemsHow to Assign Audit Space for the Audit Trail
- audit classes as argumentsAudit Classes and Preselection
- configuring policyHow to Change Audit Policy
- configuring queue controlsHow to Change Audit Queue Controls
- descriptionAudit Service Man Pages
- displaying audit defaultsDisplaying Audit Service Defaults
- –getplugin option
- policy optionsHow to Change Audit Policy
- preselecting audit classesHow to Preselect Audit Classes
- queue control optionsHow to Change Audit Queue Controls
- sending files to remote repository
- –setflags optionHow to Preselect Audit Classes
- –setnaflags optionHow to Preselect Audit Classes
- –setplugin option
- setting active audit policySetting a Temporary Audit Policy
- setting audit policyHow to Audit All Commands by Users
- setting audit policy temporarilySetting a Temporary Audit Policy
- setting audit_binfile attributesHow to Assign Audit Space for the Audit Trail
- setting audit_remote attributes
- setting system-wide audit parametersAudit Classes and Preselection
- viewing default audit preselectionHow to Preselect Audit Classes
- adding audit file systems
- auditd daemon
- refreshing audit serviceExample: Configuring Oracle Solaris Auditing
- refreshing audit service
- auditing
- adding audit flags to a group of usersCreating a Rights Profile for a Group of Users
- all commands by usersHow to Audit All Commands by Users
- Audit Remote Server (ARS)Managing a Remote Repository
- auditors' perspectiveBest Practices for Auditing Core System Files
- configuring
- all zonesConfiguring the Audit Service
- global zoneSetting the ahlt Audit Policy Option
- identically for all zonesHow to Configure All Zones Identically for Auditing
- all zones
- configuring in global zoneImplementing One Audit Service for All Zones
- crontab editingS failurecrontab File Editing Fails With Audit Context Error
- crontab filescrontab File Editing Fails With Audit Context Error
- customizingCustomizing What Is Audited
- default configurationDefault Configuration of the Audit Service
- defaultsAudit Service
- determining if runningAudit Records Are Not Being Logged
- finding changes to specific filesHow to Find Audit Records of Changes to Specific Files
- getting queue controlsHow to Change Audit Queue Controls
- local definitionAudit Terminology and Concepts
- man page summariesAudit Service Man Pages
- planningConcepts in Planning Auditing
- planning in zonesPlanning Auditing in Zones
- plugin modulesAudit Plugin Modules
- plugin to Oracle Audit Vault and Database FirewallUsing Oracle Audit Vault and Database Firewall for Storage and Analysis of Audit
Records
- post-selection definitionAudit Terminology and Concepts
- preselection definitionAudit Terminology and Concepts
- remote definitionAudit Terminology and Concepts
- removing user-specific audit flagsRemoving a User's Audit Flags
- rights profiles forRights Profiles for Administering
Auditing
- setting queue controlsHow to Change Audit Queue Controls
- sftp file transfersHow to Audit FTP and SFTP File Transfers
- troubleshootingTroubleshooting the Audit Service
- troubleshooting praudit commandProcessing praudit Output With a Script
- updating information
- adding audit flags to a group of users
- auditlog file
- text audit recordsHow to Configure syslog Audit Logs
- text audit records
- auditrecord command
- [] (square brackets) in outputAudit Record Analysis
- descriptionAudit Service Man Pages
- displaying audit record definitionsDisplaying Audit Record Definitions
- listing all formatsDisplaying Audit Record Definitions
- listing formats of classDisplaying the Audit Record Definitions of an Audit Class
- listing formats of programDisplaying the Audit Record Definitions of a Program
- optional tokens ([])Audit Record Analysis
- [] (square brackets) in output
- auditreduce command
- –b optionCombining and Reducing Audit Files
- cleaning up audit filesHow to Clean Up a not_terminated Audit File
- descriptionAudit Service Man Pages
- filtering optionsSelecting Audit Events to Be Displayed
- merging audit recordsHow to Merge Audit Files From the Audit Trail
- –O option
- selecting audit recordsSelecting Audit Events to Be Displayed
- time stamp useHow to Merge Audit Files From the Audit Trail
- trailer tokens, andtrailer Token
- using lowercase optionsSelecting Audit Events to Be Displayed
- using uppercase optionsHow to Merge Audit Files From the Audit Trail
- –b option
- auditstat command
- descriptionAudit Service Man Pages
- description
B
- –b option
- auditreduce commandCombining and Reducing Audit Files
- auditreduce command
- binary and remote recordsAbout Binary Records
C
- caret (^)
- in audit class prefixesHow to Configure a User's Audit Characteristics
- using prefix in audit_flags valueModifying Audit Preselection Exception for One User
- in audit class prefixes
- changing
- audit_class fileHow to Add an Audit Class
- audit_event fileHow to Change an Audit Event's Class Membership
- auditing defaultsHow to Preselect Audit Classes
- audit_class file
- classes Seeaudit classes
- cleaning up
- binary audit filesHow to Clean Up a not_terminated Audit File
- binary audit files
- cmd audit tokencmd Token
- cnt audit policy
- descriptionEffects of Audit Policy Options
- with ahlt policyAudit Policies for Asynchronous and Synchronous Events
- description
- combining audit files
- auditreduce commandHow to Merge Audit Files From the Audit Trail
- from different zonesAuditing and Oracle Solaris Zones
- auditreduce command
- compressing
- audit files on diskHow to Compress Audit Files on a Dedicated File System
- audit files on disk
- configuration decisions
- auditing
- file storagePlanning Disk Space for Audit Records
- remote file storagePreparing to Stream Audit Records to Remote Storage
- who and what to auditHow to Plan Who and What to Audit
- file storage
- auditing
- configuration files
- auditingAudit Service Man Pages
- auditing
- configured audit policy
- permanent audit policyHow to Change Audit Policy
- permanent audit policy
- configuring
- active audit policySetting a Temporary Audit Policy
- ahlt audit policySetting the ahlt Audit Policy Option
- audit classesHow to Preselect Audit Classes
- audit logs task mapConfiguring Audit Logs
- audit policyHow to Change Audit Policy
- audit policy temporarilySetting a Temporary Audit Policy
- audit queue controlsHow to Change Audit Queue Controls
- audit service policyHow to Change Audit Policy
- audit trail overflow preventionPreventing Audit Trail Overflow
- audit_class fileHow to Add an Audit Class
- audit_event fileHow to Change an Audit Event's Class Membership
- audit_warn scriptHow to Configure the audit_warn Email Alias
- auditingConfiguring the Audit Service
- auditing reportsUsing Oracle Audit Vault and Database Firewall for Storage and Analysis of Audit
Records
- auditing task mapConfiguring the Audit Service
- identical auditing for non-global zonesHow to Configure All Zones Identically for Auditing
- per-zone auditingHow to Configure Per-Zone Auditing
- permanent audit policyHow to Change Audit Policy
- perzone audit policySetting the perzone Audit Policy
- space for audit trailHow to Assign Audit Space for the Audit Trail
- temporary audit policyHow to Change Audit Policy
- text summaries of audit recordsHow to Configure syslog Audit Logs
- active audit policy
- converting
- audit records to readable formatViewing a Specific Audit File
- audit records to readable format
- Coordinated Universal Time (UTC)
- time stamp use in auditing
- copying audit records to single fileMerging Selected Records to a Single File
- core files
- auditing changes toBest Practices for Auditing Core System Files
- auditing changes to
- cost control
- and auditingControlling Auditing Costs
- and auditing
- creating
- audit trailAudit Trail
- rights profile for a group of usersCreating a Rights Profile for a Group of Users
- storage for binary audit filesHow to Create ZFS File Systems for Audit Files
- audit trail
- cusa audit classCollecting Audit Records for External Auditors
D
- debugging sequence numbersequence Token
- defaults
- audit serviceAudit Service
- audit service
- deleting
- archived audit filesPreventing Audit Trail Overflow
- not_terminated audit filesHow to Clean Up a not_terminated Audit File
- archived audit files
- determining
- audit ID of a userHow to Update the Preselection Mask of Logged In Users
- whether auditing is runningAudit Records Are Not Being Logged
- audit ID of a user
- disabling
- audit policyHow to Change Audit Policy
- audit serviceEnabling and Disabling the Audit Service
- audit policy
- disk space requirements
- displaying
- audit policiesHow to Change Audit Policy
- audit policy defaultsDisplaying Audit Service Defaults
- audit queue controls
- audit record definitionsDisplaying Audit Record Definitions
- audit recordsViewing the Contents of Binary Audit Files
- audit records in XML formatPutting Audit Records in XML Format
- auditing defaultsDisplaying Audit Service Defaults
- definition of audit recordsDisplaying Audit Record Definitions
- exceptions to system-wide auditingDisplaying Audit Service Defaults
- selected audit recordsHow to Merge Audit Files From the Audit Trail
- audit policies
E
- /etc/security/audit_event file
- audit events andAudit Events
- audit events and
- /etc/syslog.conf file
- efficiency
- auditing andAuditing Efficiently
- auditing and
- enabling
- audit serviceEnabling and Disabling the Audit Service
- audit service
- environment variables
- audit token forexec_env Token
- presence in audit records
- audit token for
- event
- descriptionAudit Events
- description
- event modifiers
- audit recordsheader Token
- audit records
- exec_args audit token
- argv policy andexec_args Token
- formatexec_args Token
- argv policy and
- exec_env audit token
- formatexec_env Token
- format
F
- failure and success events
- audit class prefixAudit Class Syntax
- audit class prefix
- fe audit event modifierheader Token
- file transfers
- file vnode audit tokenattribute Token
- file audit token
- formatfile Token
- format
- files See Alsoaudit files
- audit_classAudit Service Man Pages
- audit_eventAudit Service Man Pages
- auditing modifications toHow to Find Audit Records of Changes to Specific Files
- public objectsAudit Terminology and Concepts
- syslog.confAudit Service Man Pages
- audit_class
- flags line
- process preselection maskProcess Audit Characteristics
- process preselection mask
- fmri audit token
- formatfmri Token
- format
- format of audit records
- auditrecord commandDisplaying Audit Record Definitions
- auditrecord command
- fp audit event modifierheader Token
- ftp command
- logging file transfersHow to Audit FTP and SFTP File Transfers
- logging file transfers
G
- group audit policy
- and group token
- descriptionEffects of Audit Policy Options
- group audit token
- formatgroup Token
- group policy, andgroup Token
- format
H
- hard disk
- space requirements for auditingCost of Storage of Audit Data
- space requirements for auditing
- header audit token
- event modifiersheader Token
- formatheader Token
- order in audit recordheader Token
- event modifiers
I
- IDs
- audit
- mechanismProcess Audit Characteristics
- overviewWhat Is Auditing?
- mechanism
- audit sessionProcess Audit Characteristics
- audit
- Internet-related audit tokens
- ip address tokenip address Token
- ip port tokenip port Token
- socket tokensocket Token
- ip address token
- ip address audit token
- formatip address Token
- format
- ip port audit token
- formatip port Token
- format
- IPC type field values (ipc token)ipc Token
- ipc audit tokenipc Token
- IPC_perm audit token
- formatIPC_perm Token
- format
L
- limiting
- audit file sizeBinary Audit File Sizes Grow Without Limit
- audit file size
- local auditingAudit Terminology and Concepts
- log files
- /var/adm/messagesTroubleshooting the Audit Service
- /var/log/syslogTroubleshooting the Audit Service
- audit records
- configuring for audit serviceHow to Configure syslog Audit Logs
- syslog audit recordsAudit Service Man Pages
- /var/adm/messages
- logadm command
- archiving text summary audit filesPreventing Audit Trail Overflow
- archiving text summary audit files
- logging
- ftp file transfersHow to Audit FTP and SFTP File Transfers
- ftp file transfers
- logging in
- auditing loginsLogins From Other Operating Systems Not Being Audited
- auditing logins
M
- man pages
- audit serviceAudit Service Man Pages
- audit service
- managing
- audit records task mapManaging Audit Records on Local Systems
- audit trail overflowPreventing Audit Trail Overflow
- audit records task map
- mappings
- events to classes (auditing)Audit Classes and Preselection
- events to classes (auditing)
- mask (auditing)
- description of process preselectionProcess Audit Characteristics
- description of process preselection
- merging
- binary audit recordsHow to Merge Audit Files From the Audit Trail
- binary audit records
- minus sign (-)
- audit class prefixAudit Class Syntax
- audit class prefix
- modifying
- user security attributesHow to Configure a User's Audit Characteristics
- user security attributes
- monitoring
- audit trail in real timeAuditing Efficiently
- audit trail in real time
N
- na audit event modifierheader Token
- naming conventions
- audit filesConventions for Binary Audit File
Names
- audit files
- never-audit classes
- process preselection maskProcess Audit Characteristics
- process preselection mask
O
- Oracle Audit Vault and Database Firewall
- overflow prevention
- audit trailPreventing Audit Trail Overflow
- audit trail
P
- path audit policy
- descriptionEffects of Audit Policy Options
- description
- path audit token
- formatpath Token
- format
- path_attr audit tokenpath_attr Token
- permanent audit policy
- configured audit policyHow to Change Audit Policy
- configured audit policy
- perzone audit policy
- descriptionEffects of Audit Policy Options
- using
- description
- planning
- auditingConcepts in Planning Auditing
- auditing in zonesPlanning Auditing in Zones
- auditing
- plugins
- auditingAudit Plugin Modules
- auditing
- plus sign (+) in audit class prefixesHow to Configure syslog Audit Logs
- plus sign (+) in audit class prefixesAudit Class Syntax
- policies
- for auditingUnderstanding Audit Policy
- that add tokens to audit recordsAudit Policy
- for auditing
- post-selection in auditingAudit Terminology and Concepts
- praudit command
- converting audit records to readable formatViewing a Specific Audit File
- descriptionAudit Service Man Pages
- piping auditreduce output toPrinting the Entire Audit Trail
- using in a scriptProcessing praudit Output With a Script
- viewing audit recordsViewing the Contents of Binary Audit Files
- XML formatPutting Audit Records in XML Format
- converting audit records to readable format
- prefixes for audit classesAudit Class Syntax
- preselecting
- audit classesHow to Preselect Audit Classes
- audit classes
- preselection in auditingAudit Terminology and Concepts
- preselection mask (auditing)
- descriptionProcess Audit Characteristics
- description
- preventing audit trail overflowPreventing Audit Trail Overflow
- printing
- audit logPrinting the Entire Audit Trail
- audit log
- privilege audit tokenprivilege Token
- process audit characteristics
- audit session IDProcess Audit Characteristics
- audit user IDProcess Audit Characteristics
- process preselection maskProcess Audit Characteristics
- terminal IDProcess Audit Characteristics
- audit session ID
- process preselection mask
- descriptionProcess Audit Characteristics
- description
- process audit token
- formatprocess Token
- format
- processing time costs of audit serviceCost of Increased Processing Time of Audit Data
- public directories
- auditingAudit Terminology and Concepts
- auditing
- public objects
- auditingAudit Terminology and Concepts
- auditing
- public audit policy
- descriptionEffects of Audit Policy Options
- read-only eventsEffects of Audit Policy Options
- description
Q
- qsize attribute
- audit pluginsHow to Change Audit Queue Controls
- audit plugins
R
- rd audit event modifierheader Token
- readable audit record format
- converting audit records toViewing a Specific Audit File
- converting audit records to
- reducing
- audit file sizeHow to Merge Audit Files From the Audit Trail
- disk space required for audit filesHow to Compress Audit Files on a Dedicated File System
- storage-space requirements for audit filesAuditing Efficiently
- audit file size
- refreshing audit serviceExample: Configuring Oracle Solaris Auditing
- remote auditingAudit Terminology and Concepts
- removing
- audit events from audit_event fileHow to Prevent the Auditing of Specific Events
- user-specific auditingRemoving a User's Audit Flags
- audit events from audit_event file
- replacing preselected audit classesHow to Preselect Audit Classes
- return audit token
- formatreturn Token
- format
- rights
- audit profilesRights Profiles for Administering
Auditing
- audit profiles
- rights profiles
- audit service andRights Profiles for Administering
Auditing
- audit service and
- root role
- crontabauditing error messagecrontab File Editing Fails With Audit Context Error
- crontabauditing error message
S
- scripts
- audit_warn script
- monitoring audit files exampleAuditing Efficiently
- processing praudit outputProcessing praudit Output With a Script
- security
- selecting
- audit classesHow to Preselect Audit Classes
- audit recordsSelecting Audit Events to Be Displayed
- events from audit trailSelecting Audit Events to Be Displayed
- audit classes
- seq audit policy
- and sequence token
- descriptionEffects of Audit Policy Options
- sequence audit token
- and seq audit policysequence Token
- formatsequence Token
- and seq audit policy
- session ID
- –setplugin option
- setting
- arge policyHow to Audit All Commands by Users
- argv policyHow to Audit All Commands by Users
- audit policyHow to Change Audit Policy
- audit queue controlsHow to Change Audit Queue Controls
- arge policy
- sftp command
- auditing file transfersHow to Audit FTP and SFTP File Transfers
- auditing file transfers
- size of audit files
- reducing storage-space requirementsAuditing Efficiently
- reducing storage-space requirements
- SMF
- auditd serviceAudit Service
- auditd service
- socket audit tokensocket Token
- sp audit event modifierheader Token
- square brackets ([])
- auditrecord outputAudit Record Analysis
- auditrecord output
- starting auditingEnabling and Disabling the Audit Service
- storage costs and auditingCost of Storage of Audit Data
- storage overflow prevention
- audit trailPreventing Audit Trail Overflow
- audit trail
- storing
- audit files remotelyPreparing to Stream Audit Records to Remote Storage
- audit files remotely
- subject audit token
- formatsubject Token
- format
- success and failure events
- audit class prefixAudit Class Syntax
- audit class prefix
- svcadm command
- restartingHow to Configure syslog Audit Logs
- restarting
- syslog.conf file
- and auditingAudit Service Man Pages
- audit.notice levelHow to Configure syslog Audit Logs
- and auditing
- syslog recordsAbout syslog Audit Records
- system calls
- argument audit tokenargument Token
- exec_args audit tokenexec_args Token
- exec_env audit tokenexec_env Token
- return audit tokenreturn Token
- argument audit token
- System V IPC
- ipc audit tokenipc Token
- IPC_perm audit tokenIPC_perm Token
- ipc audit token
T
- tail command
- example of useAuditing Efficiently
- example of use
- task maps
- configuring audit logsConfiguring Audit Logs
- configuring auditingConfiguring the Audit Service
- managing audit recordsManaging Audit Records on Local Systems
- planning auditingConcepts in Planning Auditing
- configuring audit logs
- TCP addressesip port Token
- temporary audit policy
- active audit policyHow to Change Audit Policy
- active audit policy
- terminal ID
- text audit token
- formattext Token
- format
- time stamps
- audit filesConventions for Binary Audit File
Names
- audit files
- trail audit policy
- and trailer tokenEffects of Audit Policy Options
- descriptionEffects of Audit Policy Options
- and trailer token
- trailer audit token
- formattrailer Token
- order in audit recordtrailer Token
- praudit displaytrailer Token
- format
- troubleshooting
- active pluginNo Audit Plugin Active
- audit classes
- praudit commandProcessing praudit Output With a Script
- too many audit records in queueTuning the Audit Queue Buffer Size
- active plugin
U
- UDP
- addressesip port Token
- using for remote audit logsAudit Logs
- addresses
- use of authorization audit tokenuse of authorization Token
- use of privilege audit tokenuse of privilege Token
- user ID
- audit ID andProcess Audit Characteristics
- audit ID and
- user ID and audit IDWhat Is Auditing?
- User Security rights profile
- modifying audit preselection for usersHow to Configure a User's Audit Characteristics
- modifying audit preselection for users
- user audit tokenuser Token
- user_attr database
- listing user exceptions to audit preselectionHow to Configure a User's Audit Characteristics
- listing user exceptions to audit preselection
- user_attr file
- exceptions to system-wide audit classesAudit Classes and Preselection
- exceptions to system-wide audit classes
- userattr command
- displaying exceptions to system-wide auditingDisplaying Audit Service Defaults
- displaying exceptions to system-wide auditing
- usermod command
- audit_flags keywordHow to Configure a User's Audit Characteristics
- exceptions to system-wide auditingAudit Classes and Preselection
- specifying user exceptions to audit preselectionHow to Configure a User's Audit Characteristics
- using caret (^) prefix for audit_flags exceptionModifying Audit Preselection Exception for One User
- audit_flags keyword
- users
- auditing all commandsHow to Audit All Commands by Users
- auditing individual usersAuditing Selected Users, No System-Wide Auditing
- creating rights profile for a groupCreating a Rights Profile for a Group of Users
- modifying audit preselection mask ofHow to Configure a User's Audit Characteristics
- removing audit flagsRemoving a User's Audit Flags
- auditing all commands
V
- /var/adm/auditlog file
- text audit recordsHow to Configure syslog Audit Logs
- text audit records
- /var/adm/messages file
- troubleshooting auditingTroubleshooting the Audit Service
- troubleshooting auditing
- /var/log/syslog file
- troubleshooting auditingTroubleshooting the Audit Service
- troubleshooting auditing
- variables
- adding to audit record
- auditing those associated with a commandcmd Token
- viewing
- audit record definitionsDisplaying Audit Record Definitions
- binary audit filesViewing the Contents of Binary Audit Files
- XML audit recordsPutting Audit Records in XML Format
- audit record definitions
- vnode audit token
- formatattribute Token
- format
W
- wr audit event modifierheader Token
X
- xclient audit tokenxclient Token
- XML format
- audit recordsPutting Audit Records in XML Format
- audit records
Z
- ZFS File System Management rights profile
- creating audit file systemsHow to Create ZFS File Systems for Audit Files
- creating audit file systems
- ZFS file systems
- creating for binary audit filesHow to Create ZFS File Systems for Audit Files
- creating for binary audit files
- ZFS Storage Management rights profile
- creating pools for audit filesHow to Create ZFS File Systems for Audit Files
- creating pools for audit files
- zonename audit policy
- descriptionEffects of Audit Policy Options
- description
- zonename audit tokenzonename Token
- zones
- configuring auditing in global zoneSetting the ahlt Audit Policy Option
- perzone audit policy
- planning auditing inPlanning Auditing in Zones
- zonename audit policy
- configuring auditing in global zone