Configuring auditing

Displaying auditing subsystem settings

The auditlog command, when invoked with no options, will display the following auditing information:

the current status of auditing
the full pathname of the primary audit event log file
the audit buffer high water mark
the maximum file size of the audit event log file
the action to be taken upon a log full condition
the action to be taken upon an error condition
the full pathname of the alternate audit event log file
the program to be run upon a log full condition of SWITCH

The following example illustrates the output of auditlog:

   # auditlog
   Current Status of Auditing:	ON
   Current Event Log:	/var/audit/0415477
   Current Audit Buffer High Water Mark:	20480 bytes
   Current Maximum File Size Setting:	1000 blocks
   Action To Be Taken Upon Full Event Log:	log switch
   Action To Be Taken Upon Error:	disable
   Next Event Log To Be Used:	/var/audit/MMDD###
   Program To Be Run When Event Log Is Full:	/etc/security/audit/alog.sh

The first line of the output reports the status of auditing; it will be either ON or OFF. If auditing is on, the rest of the display reports the current audit settings. If auditing is off, the display reports the settings that will take effect when auditing is enabled next.