Specifying The Audit Policy - Fujitsu SPARC Enterprise M4000 User Manual

Specifying the Audit Policy

■
1. Use the showaudit (8) command to display the audit policy.
XSCF> showaudit all
Auditing:
Audit space used:
Audit space free:
Records dropped:
Policy on full trail: suspend
User global policy:
Mail:
Thresholds:
User policy:
Events:
:
2. Use the setaudit (8) command to set the audit policy.
<Example 1> Specify three users, enable the AUDIT and LOGIN groups
for the Audit class, enable SSH login for the Audit event, and
disable the global policy for the users.
XSCF> setaudit –a yyyyy,uuuuu,nnnnn=enabe –c ACS_AUDIT,ACS_LOGIN=
enable –e AEV_LOGIN_SSH=enable –g disable
<Example 2> Specify the file warning send destination address,
count for the trail-full write mode, and file space warning
threshold.
XSCF> setaudit –m yyyy@example.com –p count –t 50,75,90
3. Use the showaudit (8) command to confirm the setting.
2-66 SPARC Enterprise Mx000 Servers XSCF User's Guide • April 2008
Command operation
AEV_AUDIT_START
AEV_AUDIT_STOP
enabled
13713 (bytes)
4180591 (bytes)
0
enabled
80% 100%
enabled
enabled