Recently I was working trying to activate the solaris audit service to record logs and write them in a single file in /var/adm/auditlog.
The thing is, I was trying to find some useful info about it over internet and I could not found it too much.
First, I checked the audit service status with auditconfig -getcond and it is Enable, I disable the audit service using -t parameter with the command audit. (audit -t). And enable it again with root user.
I have the default auditing parameters (audit_event, audit_class, policies, etc). And I don't know where these logs are written or I don't know how can I make that the audit logs saved in a single file.
Please, any help with my case?.
See ya,
syslog
log the audit records. See How to Configure syslog Audit Logs