Enabling Auditing

Enabling Auditing

The audit subsystem is distributed with your IRIX operating system media, but is not installed by default. To enable auditing, you must use Inst to install the eoe2.sw.audit software package from your distribution media. inst is described in detail in the Software Installation Guide. Once this package has been installed, reboot your system and use the chkconfig utility to enable auditing. The chkconfig(1M) reference page provides complete information on the use of chkconfig but, simply described, you will see a list of configurable options and a notation of off or on for each option. The list is in alphabetical order.

For example, here is a partial chkconfig listing that includes the audit option:

Flag                 State
====                 =====
audit                off
automount            on
windowsystem         on
xdm                  off

The following command enables auditing on your system:

chkconfig audit on

The system immediately begins collecting audit data on the default set of audit events. The default audit events are listed and described below.