Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 360

Example 30.2 Example Audit Rules—Audit System Parameters
-b 1000
-f 1
-r 10
-e 1
Specify the maximum number of outstanding audit buffers. Depending on the
level of logging activity, you might need to adjust the number of buffers to avoid
causing too heavy an audit load on your system.
Specify the failure flag to use. See
for possible values.
Specify the maximum number of messages per second that may be issued by the
kernel. See
Enable or disable the audit subsystem.
Using audit, you can track any kind of file system access to important files, configura-
tions or resources. You can add watches on these and assign keys to each kind of watch
for better identification in the logs.
348 Security Guide
Table 30.1, "Audit Status Flags"
Table 30.1, "Audit Status Flags"
(page 346) for details.
(page 346)