Novell LINUX ENTERPRISE DESKTOP 11, Manual, Page: 402 / 450

Example 30.2 Example Audit Rules—Audit System Parameters
-b 1000
❶
-f 1
❷
-r 10
❸
-e 1
❹
❶
Specify the maximum number of outstanding audit buffers. Depending on the
level of logging activity, you might need to adjust the number of buffers to avoid
causing too heavy an audit load on your system.
❷
Specify the failure flag to use. See Table 30.1, “Audit Status Flags” (page 386)
for possible values.
❸ Specify the maximum number of messages per second that may be issued by the
kernel. See
Table 30.1, “Audit Status Flags” (page 386) for details.
❹
Enable or disable the audit subsystem.
Using audit, you can track any kind of file system access to important files, configura-
tions or resources. You can add watches on these and assign keys to each kind of watch
for better identification in the logs.
388 Security Guide