Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 349

• Remote Host Address
• System Call
• System Call Arguments
• File
• File Operations
• Success or Failure
Apply a Selective Audit
Audit provides the means to filter the audit reports for events of interest and also
to tune audit to record only selected events. You can create your own set of rules
and have the audit daemon record only those of interest to you.
Guarantee the Availability of the Report Data
Audit reports are owned by root and therefore only removable by root. Unau-
thorized users cannot remove the audit logs.
Prevent Audit Data Loss
If the kernel runs out of memory, the audit daemon's backlog is exceeded, or its
rate limit is exceeded, audit can trigger a shutdown of the system to keep events
from escaping audit's control. This shutdown would be an immediate halt of the
system triggered by the audit kernel component without any syncing of the latest
logs to disk. The default configuration is to log a warning to syslog rather than to
halt the system.
If the system runs out of disk space when logging, the audit system can be config-
ured to perform clean shutdown (init 0). The default configuration tells the audit
daemon to stop logging when it runs out of disk space.
Understanding Linux Audit 337