HP 9000 Containers A.03.01 on HP Integrity Server Administrator Guide HP-UX 11i v3 (5900-3112, June 2013)

$ /opt/audit/AudReport/bin/srp_auditdp_copy \
–r <global_log> -R <local_log>
To view the copied records from within a system container:
$ audisp <local_log>
Legacy system containers have a major limitation; the login and logoff events are not included in
audit logs. The workaround is to write an init.d startup script that runs the following commands:
echo ”audit_en_logins_compat/W 1" | adb -o –w /stand/vmunix/dev/kmem
echo "audit_logoff_compat/W 1" | adb -o -w /stand/vmunix/dev/kmem
For HP 9000 classic containers, users are selected in the global (/etc and /tcb are shared
between the host and the container). The audit records contain information for the global and the
container (only one HP 9000 classic container is supported on a host). Currently, there is no way
to filter records for the container.
8.13 Auditing with HP 9000 Containers 59