audfilterd.1m (2010 09)

a
audfilterd(1M) audfilterd(1M)
WARNING
Since the audfilterd daemon relies on intercepting successful mount events to keep the policy to date,
auditing mount() and vfsmount() system calls is strongly recommended. If
mount() and
vfsmount() calls are not audited, audfilterd will not notice changes to the mounted file systems in
a timely manner, and the rules will only be resynchronized after the daemon wakes itself up as specified
by the argument to the -t
option.
AUTHOR
audfilterd was developed by the Hewlett-Packard Company.
FILES
/etc/audit/filter.conf
Configuration file that contains audit filtering rules.
/var/spool/audfilterd/daemon
Daemon’s Unix domain socket.
/var/spool/audfilterd/filter.conf.cache
Copy of /etc/audit/filter.conf
file that was last loaded to the kernel.
/var/spool/audfilterd/client*
Client Unix domain sockets.
SEE ALSO
audfilter(1M), filter.conf(4).
2 Hewlett-Packard Company 2 HP-UX 11i Version 3: September 2010