Oracle SPARC Enterprise M3000, Reference Manual

Page: 181 / 552

setaudit(8)
System Administration 167
OPERANDS The following operands are supported:
EXAMPLES
EXAMPLE 1
Changing Classes Using Names
Auditing for
LOGIN
and
AUDIT
classes has been disabled. Auditing for
READ
class
is enabled.
EXAMPLE 2
Changing Classes Using Numbers
Auditing for classes 8 (
LOGIN
) and 16 (
AUDIT
) has been disabled. Auditing for class
1 (SYSTEM) is enabled.
EXAMPLE 3
Changing Classes and Enabling an Event
Auditing is enabled for all of Class 1 (SYSTEM) except for event 64 (USER) is
disabled.
-t
percents
Sets thresholds at which to issue a warning about local audit storage usage.
percents is a comma-separated list of percentages of available space used. At
most four values may be set. For example, values of
50
,
75, 80, 90
would
cause warnings to be issued when 50%, 75%, 80% and 90% respectively, of the
available storage for audit records is consumed. The default value is 80%.
Warnings are issued as a message to the console and optionally to an
administrator using email. See
-m
mailaddr .
archive
Notifies the log archiving facility to archive the current audit trail.
delete
Delete the portion of the local audit trail in the secondary
partition. This can be used to free space for new audit records if
the local audit trail becomes full. For more information on the
secondary partition, refer to the
Administration Guide for your
server.
disable
Turns off the writing of audit records to the audit trail and
notifies the log archiving facility to archive the current audit trail.
enable
Turns on the writing of audit records to the audit trail.
XSCF>
setaudit -c LOGIN,AUDIT=disable -c ACS_READ=enable
XSCF>
setaudit -c 8,16=disable -c 1=enable
XSCF>
setaudit -c 1=enable -e 64=disable