HP-UX System Administrator's Guide: Security Management HP-UX 11i v3 (B3921-90020, September 2010)

NOTE:
1. With HP-UX 11i version 3, an auxiliary audit trail does not need to be specified;
the auditing system does switching of audit trails automatically.
2. If autoswitching failed and the current audit trail continues to grow past the FSS
point, all auditable actions are suspended for regular users. The system can be
restored by archiving the audit data, or specifying a new audit log file on a file
system with space.
3. If other activities consume space on the file system, or the file system chosen has
insufficient space for the AFS size chosen, the File Space Switch point can be reached
before the Audit File Switch point.
Choose a file system with adequate space for the audit log files. You can assess the size
of the file systems using the bdf command. HP recommends you configure the log
files to reside on a file system with at least 5 MB of available space and with at least
20% of its total file space available.
The growth of audit log files is closely monitored by the audit overflow monitor daemon,
audomon, to insure that no audit data is lost.
9.5.1 Configuring Audit Trails
Use the audsys command to specify the primary audit log file and the (optional)
auxiliary audit log file to collect auditing data:
#audsys -n -N2 -c my_audit_trail -s 5000
This example starts the audit system and records data in the my_audit_trail
directory, using two writer threads. The AFS size is set to 5000K bytes.
The audsys command recognizes the following options:
-c file|directory
Specifies a "current" trail.
-f
Turns off the auditing system.
-n
Turns on the auditing system.
-N num
Specifies the number of active files that comprise an audit
trail.
-s cafs Specifies cafs, the "current" trail's AuditFileSwitch (AFS)
size (in kbytes).
-x file|directory
Specifies the "next" audit trail.
-z xafs Specifies xafs, the "next" trail's AuditFileSwitch (AFS) size
(in kbytes).
For more information, see audsys(1M) .
174 Audit Administration