Solaris

the auditor has come in today and requesting for all sorts of system logs and I spent the better part of the yesterday with my boss "correcting defiencies" on our boxes

one of the things the auditor has requested was the audit_user file under /etc/security. I checked docs.sun.com it doesn't tell me very much and I'm quite clueless as to what it does. My file has only 1 entry and it's the same in all the other boxes.

#
# Copyright (c) 1988 by Sun Microsystems, Inc.
#
#ident @(#)audit_user.txt 1.5 97/01/08 SMI
#
#
# User Level Audit User File
#
# File Format
#
# username:always:never
#
root:lo:no



docs.sun.com says :
Example - Creating an Audit Admin Login
If all the audit partitions are full, then it could be impossible to log in to a host. If all logins are audited, then the fact that the audit partitions are full would prevent anyone from completing a login. To avoid this situation, you can set up a special login that is not audited. This new login would allow you to log in to the host even if the audit partitions are full. Then, you could fix the problem with the full partitions. In this example, the user auditadm is defined so that no auditing takes place.


But I still don't get any of it. My question is what does this file do? If I were to add a user to the file to be audited what sort of auditing takes place? are there supposed to be any logs or binary databases where it will store auditing infomation of the users that I can check? What does auditing partitions refer to? Does it mean a kind of auditing database?

anybody can help to explain?

thanks in advance.

Look up the following man pages

audit_user
audit_control

These should explain it quite well.

root:lo:no
root:login_logout:no_class
username : always audit : never audit

thx for the explaination RTM