Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 400 / 450

The main auditctl commands to control basic audit system parameters are:
• auditctl -e
to enable or disable audit
• auditctl -f
to control the failure flag
• auditctl -r
to control the rate limit for audit messages
• auditctl -b
to control the backlog limit
• auditctl -s
to query the current status of the audit daemon
The
-e
,
-f
,
-r
, and
-b
options can also be specified in the
audit.rules
file to
avoid having to enter them each time the audit daemon is started.
Any time you query the status of the audit daemon with
auditctl -s
or change the
status flag with
auditctl -e flag
a status messages including information on each
of the above-mentioned parameters is output. The following example highlights the
typical audit status message.
Example 30.1 Example output of auditctl -s
AUDIT_STATUS: enabled=1 flag=2 pid=3105 rate_limit=0 backlog_limit=8192 lost=0
backlog=0
Table 30.1 Audit Status Flags
Command Meaning [Possible Values] Flag
auditctl -e
[0|1] Set the enable flag. [0..2] 0=disable,
1=enable, 2=enable and lock down the
configuration enabled
auditctl -f
[0|1|2] Set the failure flag. [0..2] 0=silent,
1=printk, 2=panic (immediate halt with-
out syncing pending data to disk) flag
— Process ID under which auditd is running. pid
386 Security Guide