Go to main content
oracle home
Managing Auditing in Oracle
®
Solaris 11.3
Exit Print View
Search Term
Search Scope:
This Document
Entire Library
» ...
Documentation Home
»
Oracle Solaris 11.3 Information Library
»
Managing Auditing in Oracle
®
...
Updated: April 2019
Managing Auditing in Oracle
®
Solaris 11.3
Document Information
Using This Documentation
Product Documentation Library
Feedback
Chapter 1 About Auditing in Oracle Solaris
What Is Auditing?
Audit Terminology and Concepts
Audit Events
Audit Classes and Preselection
Audit Records and Audit Tokens
Audit Plugin Modules
Audit Remote Server
Audit Logs
About Binary Records
About syslog Audit Records
Storing and Managing the Audit Trail
Ensuring Reliable Time Stamps
Managing a Remote Repository
How Is Auditing Related to Security?
How Does Auditing Work?
How Is Auditing Configured?
Using Oracle Audit Vault and Database Firewall for Storage and Analysis of Audit Records
Auditing on a System With Oracle Solaris Zones
Chapter 2 Planning for Auditing
Concepts in Planning Auditing
Planning a Single System Audit Trail
Planning Auditing in Zones
Implementing One Audit Service for All Zones
Implementing One Audit Service Per Zone
Planning Auditing
How to Plan Who and What to Audit
Planning Disk Space for Audit Records
How to Plan Disk Space for Audit Records
Preparing to Stream Audit Records to Remote Storage
How to Prepare to Stream Audit Records to Remote Storage
Understanding Audit Policy
Controlling Auditing Costs
Cost of Increased Processing Time of Audit Data
Cost of Analysis of Audit Data
Cost of Storage of Audit Data
Auditing Efficiently
Chapter 3 Managing the Audit Service
Default Configuration of the Audit Service
Displaying Audit Service Defaults
Enabling and Disabling the Audit Service
Configuring the Audit Service
How to Preselect Audit Classes
How to Configure a User's Audit Characteristics
How to Change Audit Policy
How to Change Audit Queue Controls
How to Configure the audit_warn Email Alias
How to Add an Audit Class
How to Change an Audit Event's Class Membership
Customizing What Is Audited
How to Audit All Commands by Users
How to Find Audit Records of Changes to Specific Files
How to Update the Preselection Mask of Logged In Users
How to Prevent the Auditing of Specific Events
How to Compress Audit Files on a Dedicated File System
How to Audit FTP and SFTP File Transfers
Configuring the Audit Service in Zones
How to Configure All Zones Identically for Auditing
How to Configure Per-Zone Auditing
Example: Configuring Oracle Solaris Auditing
Chapter 4 Monitoring System Activities
Configuring Local Audit Logs
Configuring Audit Logs
How to Create ZFS File Systems for Audit Files
How to Assign Audit Space for the Audit Trail
How to Send Audit Files to a Remote Repository
How to Configure a Remote Repository for Audit Files
How to Configure syslog Audit Logs
Chapter 5 Working With Audit Data
Displaying Audit Trail Data
Displaying Audit Record Definitions
Selecting Audit Events to Be Displayed
Viewing the Contents of Binary Audit Files
Managing Audit Records on Local Systems
How to Merge Audit Files From the Audit Trail
How to Clean Up a not_terminated Audit File
Preventing Audit Trail Overflow
Chapter 6 Analyzing and Resolving Auditing Issues
Troubleshooting the Audit Service
Audit Records Are Not Being Logged
Audit Service Not Running
No Audit Plugin Active
Audit Class Undefined
No Assigned Events to Audit Class
Volume of Audit Records Is Large
Binary Audit File Sizes Grow Without Limit
Logins From Other Operating Systems Not Being Audited
crontab File Editing Fails With Audit Context Error
Best Practices for Auditing Core System Files
Chapter 7 Auditing Reference
Audit Service
Audit Service Man Pages
Rights Profiles for Administering Auditing
Auditing and Oracle Solaris Zones
Audit Configuration Files and Packaging
Audit Classes
Audit Class Syntax
Audit Plugins
Audit Remote Server
Audit Policy
Audit Policies for Asynchronous and Synchronous Events
Process Audit Characteristics
Audit Trail
Conventions for Binary Audit File Names
Audit Record Structure
Audit Record Analysis
Audit Token Formats
acl Token
argument Token
attribute Token
cmd Token
exec_args Token
exec_env Token
file Token
fmri Token
group Token
header Token
ip address Token
ip port Token
ipc Token
IPC_perm Token
path Token
path_attr Token
privilege Token
process Token
return Token
sequence Token
socket Token
subject Token
text Token
trailer Token
use of authorization Token
use of privilege Token
user Token
xclient Token
zonename Token
Audit Service Glossary
Index
Index Numbers and Symbols
Index A
Index B
Index C
Index D
Index E
Index F
Index G
Index H
Index I
Index L
Index M
Index N
Index O
Index P
Index Q
Index R
Index S
Index T
Index U
Index V
Index W
Index X
Index Z
Language:
English
Managing Auditing in Oracle
®
Solaris 11.3
April 2019
Describes how to administer auditing on Oracle Solaris systems.
Document Information
Using This Documentation
Product Documentation Library
Feedback
1 About Auditing in Oracle Solaris
What Is Auditing?
Audit Terminology and Concepts
Audit Events
Audit Classes and Preselection
Audit Records and Audit Tokens
Audit Plugin Modules
Audit Remote Server
Audit Logs
About Binary Records
About syslog Audit Records
Storing and Managing the Audit Trail
Ensuring Reliable Time Stamps
Managing a Remote Repository
How Is Auditing Related to Security?
How Does Auditing Work?
How Is Auditing Configured?
Using Oracle Audit Vault and Database Firewall for Storage and Analysis of Audit Records
Auditing on a System With Oracle Solaris Zones
2 Planning for Auditing
Concepts in Planning Auditing
Planning a Single System Audit Trail
Planning Auditing in Zones
Implementing One Audit Service for All Zones
Implementing One Audit Service Per Zone
Planning Auditing
How to Plan Who and What to Audit
Planning Disk Space for Audit Records
How to Plan Disk Space for Audit Records
Preparing to Stream Audit Records to Remote Storage
How to Prepare to Stream Audit Records to Remote Storage
Understanding Audit Policy
Controlling Auditing Costs
Cost of Increased Processing Time of Audit Data
Cost of Analysis of Audit Data
Cost of Storage of Audit Data
Auditing Efficiently
3 Managing the Audit Service
Default Configuration of the Audit Service
Displaying Audit Service Defaults
Enabling and Disabling the Audit Service
Configuring the Audit Service
How to Preselect Audit Classes
How to Configure a User's Audit Characteristics
How to Change Audit Policy
How to Change Audit Queue Controls
How to Configure the audit_warn Email Alias
How to Add an Audit Class
How to Change an Audit Event's Class Membership
Customizing What Is Audited
How to Audit All Commands by Users
How to Find Audit Records of Changes to Specific Files
How to Update the Preselection Mask of Logged In Users
How to Prevent the Auditing of Specific Events
How to Compress Audit Files on a Dedicated File System
How to Audit FTP and SFTP File Transfers
Configuring the Audit Service in Zones
How to Configure All Zones Identically for Auditing
How to Configure Per-Zone Auditing
Example: Configuring Oracle Solaris Auditing
4 Monitoring System Activities
Configuring Local Audit Logs
Configuring Audit Logs
How to Create ZFS File Systems for Audit Files
How to Assign Audit Space for the Audit Trail
How to Send Audit Files to a Remote Repository
How to Configure a Remote Repository for Audit Files
How to Configure syslog Audit Logs
5 Working With Audit Data
Displaying Audit Trail Data
Displaying Audit Record Definitions
Selecting Audit Events to Be Displayed
Viewing the Contents of Binary Audit Files
Managing Audit Records on Local Systems
How to Merge Audit Files From the Audit Trail
How to Clean Up a not_terminated Audit File
Preventing Audit Trail Overflow
6 Analyzing and Resolving Auditing Issues
Troubleshooting the Audit Service
Audit Records Are Not Being Logged
Audit Service Not Running
No Audit Plugin Active
Audit Class Undefined
No Assigned Events to Audit Class
Volume of Audit Records Is Large
Binary Audit File Sizes Grow Without Limit
Logins From Other Operating Systems Not Being Audited
crontab File Editing Fails With Audit Context Error
Best Practices for Auditing Core System Files
7 Auditing Reference
Audit Service
Audit Service Man Pages
Rights Profiles for Administering Auditing
Auditing and Oracle Solaris Zones
Audit Configuration Files and Packaging
Audit Classes
Audit Class Syntax
Audit Plugins
Audit Remote Server
Audit Policy
Audit Policies for Asynchronous and Synchronous Events
Process Audit Characteristics
Audit Trail
Conventions for Binary Audit File Names
Audit Record Structure
Audit Record Analysis
Audit Token Formats
acl Token
argument Token
attribute Token
cmd Token
exec_args Token
exec_env Token
file Token
fmri Token
group Token
header Token
ip address Token
ip port Token
ipc Token
IPC_perm Token
path Token
path_attr Token
privilege Token
process Token
return Token
sequence Token
socket Token
subject Token
text Token
trailer Token
use of authorization Token
use of privilege Token
user Token
xclient Token
zonename Token
Audit Service Glossary
Index
Numbers and Symbols
A
B
C
D
E
F
G
H
I
L
M
N
O
P
Q
R
S
T
U
V
W
X
Z