Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 353

Depending on whether you want your environment to satisfy the requirements of CAPP,
you need to be extra restrictive when configuring the audit daemon. Where you need
to use particular settings to meet the CAPP requirements, a "CAPP Environment" note
tells you how to adjust the configuration.
log_file, log_format and log_group
log_file specifies the location where the audit logs should be stored.
log_format determines how the audit information is written to disk and
log_group defines the group that owns the log files. Possible values for
log_format are raw (messages are stored just as the kernel sends them) or
nolog (messages are discarded and not written to disk). The data sent to the audit
dispatcher is not affected if you use the nolog mode. The default setting is raw
and you should keep it if you want to be able to create reports and queries against
the audit logs using the aureport and ausearch tools. The value for log_group
can either be specified literally or by the groups ID.
NOTE: CAPP Environment
In a CAPP environment, have the audit log reside on its own partition. By
doing so, you can be sure that the space detection of the audit daemon is
accurate and that you do not have other processes consuming this space.
priority_boost
Determine how much of a priority boost the audit daemon should get. Possible
values are 0 to 4, with 4 assigning the highest priority. The values given here
translate to negative nice values, as in 3 to -4 to increase the priority.
flush and freq
Specifies whether, how, and how often the audit logs should be written to disk.
Valid values for flush are none, incremental, data, and sync. none tells
the audit daemon not to make any special effort to write the audit data to disk.
incremental tells the audit daemon to explicitly flush the data to disk. A fre-
quency must be specified if incremental is used. A freq value of 20 tells the
audit daemon to request the kernel to flush the data to disk after every 20 records.
The data option keeps the data portion of the disk file in sync at all times while
the sync option takes care of both metadata and data.
Understanding Linux Audit 341