Recently I was working trying to activate the solaris audit service to record logs and write them in a single file in /var/adm/auditlog.

The thing is, I was trying to find some useful info about it over internet and I could not found it too much.

First, I checked the audit service status with auditconfig -getcond and it is Enable, I disable the audit service using -t parameter with the command audit. (audit -t). And enable it again with root user.

I have the default auditing parameters (audit_event, audit_class, policies, etc). And I don't know where these logs are written or I don't know how can I make that the audit logs saved in a single file.

Please, any help with my case?.

See ya,

  • 1
    It sounds like you want to have syslog log the audit records. See How to Configure syslog Audit Logs – Mark Plotnick Jun 7 '17 at 15:48
  • Hello Mark, Im having a problem and Im a little bit stuck, I installed a clean Solaris 11.3 version in a VirtualBox as a Virtualization Software Management, and I did these steps. auditconfig -getcond --> It shows me the audit is enable. Auditing. Also, I did the steps that Oracle site describes me and I could not obtain that audit logs can be saved in the syslog on /var/ directory. I launched this commands auditconfig -getflags and auditconfig -getnaflags and I obtain the default Solaris 11.3 configuration by default, I did not change anything about this config. – vicdeveloper Jun 18 '17 at 2:54
  • Also, I saw the auditing policy using this command: auditconfig -getpolicy and I have the cnt active as default. About the audit plugins, I used this command: auditconfig -getplugin and I have audit_binfile plugin, audit_syslog active and audit_remote inactive. I edited the /etc/syslog.conf file and add this line: audit.notice /var/adm/auditlog. I dont know what Im doing wrong :(. – vicdeveloper Jun 18 '17 at 2:55
  • If you use the logger command to send some text to audit.notice, does it appear in the auditlog file? – Mark Plotnick Jun 19 '17 at 21:00
  • Hello Mark, I use this command: logger system rebooted and it does not write me anything in the auditlog file in /var/ directory. Any help?. – vicdeveloper Jun 20 '17 at 15:15

If you kept everything out-of-the-box: Did you look into /var/audit . Keep in mind that in the default configuration of Solaris the files are in a binary format. You need to look at them with the praudit command.

  • Is not needed other configuration files to do the auditing service work as well in Solaris 11?. I was watching some files, such as audit_control, audit_user into /etc/security directory. Any idea of an example of how to config them?. – vicdeveloper Jun 20 '17 at 19:19

What does auditconfig -getcond show you?

This would show you some of the base config options, and where the binary audit data is going:

auditconfig -getplugin audit_binfile

Plugin: audit_binfile (active) Attributes: p_age=0h;p_dir=/var/audit;p_fsize=0;p_minfree=1

Have you checked the audit services in SMF? As well as the others in case something that auditd depends on is in maintenance? ie: svcs -a |grep audit; svcs -xv

I asked about the first, as for some reason on one of my Solaris 11 systems, the auditd service fails to start, and I've been unable to find a way to kick it to life.

Auditing in Oracle Solaris 11

  • auditconfig -getcond ==> this command shows me: auditing. And the service is Enable and working as well. – vicdeveloper Jun 8 '17 at 16:26
  • So, it sounds like it's working, so you should see audit files in "p_dir" which will require an auditreduce/praudit to view. Or check out the link Mark Plotnick gave you to configure syslog auditing. – sleepyweasel Jun 8 '17 at 21:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.