Audit Configuration; About Auditing - Sun Microsystems Sun SPARC Enterprise M3000 Administration Manual

5
C H A P T E R

Audit Configuration

Entry-level servers can have a single domain, while midrange and high-end servers
can run one or multiple domains. Those domains must be as secure as if they were
running on physically separate servers. To help ensure that level of security, XSCF
firmware provides the audit measures described in this chapter.
This chapter contains these sections:

About Auditing

■
XSCF Shell Procedures for Auditing
■
Related Information
■
About Auditing
The server logs all Service Processor events that could be relevant to security, such as
system startup and shutdown, user login and logout, and privilege changes.
An audit record contains information about a single event, what caused it, the time
it occurred, and other relevant information. A collection of audit records that are
linked is called an audit trail. An audit trail can reveal suspicious or abnormal
patterns of system behavior, in addition to identifying which user was responsible
for a particular event.
Auditing is implemented through:
Audit Records
■
Audit Events
■
Audit Classes
■
Audit Policy
■
Audit File Tools
■
71