audsys.1m (2010 09)

ManualsBrandsHP ManualsSoftwareHP-UX Manpages

audsys(1M) audsys(1M)

speciﬁed with the -c

option.

-N num Specify the number of active ﬁles that comprise an audit trail. The auditing system

will use one or more writer threads to log data into these ﬁles. Each writer thread

will write to one ﬁle. If the

-N num option is not speciﬁed in the current audsys

command, then the previous setting for num will be used. If there is no previous

setting, num will be set to 1. If num is greater than or equal to 1 (regular mode),

then the audit trail ﬁles are named in this format:

spu0 to spunum-1. The audit

trail ﬁles are created in the directory speciﬁed with the

-c option. For example, if

num is 3, then ﬁles named

spu0, spu1, and spu2 are created.

If num is 0 (compatibility mode), then the audit trail will be a ﬁle with the name

speciﬁed by the

-c

option.

Use the

-N option with the

-n option to turn on auditing. Use the -N option by

itself (that is, no other options are speciﬁed) to change the number of active ﬁles

when the auditing system is running in regular mode.

The recommended value for num is approximately the number of processors on the

system divided by two.

-s cafs Specify cafs , the "current" trail’s AuditFileSwitch (AFS) size (in Kbytes).

The

-c and -s options must be speciﬁed together.

-x file | directory

Specify the ﬁle or directory which will be the "next" audit trail. Any existing "next"

trail is replaced by the trail speciﬁed. The speciﬁed trail must be empty or nonex-

istent, unless it is the "current" or "next" trail already in use by the auditing system.

The

-x and -z options must be speciﬁed together.

The

-x option is supported solely for backward compatibility and will be obsoleted

in any future releases after HP-UX 11i Version 3.

If the "next" audit trail is not speciﬁed by the

-x option, the auditing system will

take the "current" audit trail’s base name with a different timestamp extension as

the "next" audit trail. The name of the "next" audit trail will be determined at the

next switch point. See audomon(1M) for more details.

Note: The auditing system modiﬁes the speciﬁed audit trail name in the following

situation:

• The current audit trail name ends with the 12 digits in

.yyyymmdd

_HHMM

format where yyyymmdd and HHMM are all digits and not necessarily a

timestamp.

• The next audit trail is not conﬁgured. That is, the

-x option is not speciﬁed.

The audit trail name change occurs when audit ﬁle switch actually happens. The

dot (

.) and underscore (_) are still part of the audit trail name. For example, the

auditing system will change /var/.audit/log.20071103_1201 to

/var/.audit/log.20071107_1123.

-z xafs Specify xafs , the "next" trail’s AuditFileSwitch (AFS) size (in Kbytes).

The

-x and -z options must be speciﬁed together.

-c is speciﬁed without -x, only the "current" audit ﬁle is changed; the existing "next" audit ﬁle

remains.

-x is speciﬁed without -c, only the "next" audit trail is changed; the existing "current" audit trail

remains.

The

-c option can be used to manually switch from the "current" to the "next" trail by specifying the

"next" trail as the new "current" trail. In this case, the trail speciﬁed becomes the new "current" trail and

the "next" trail is set to NULL.

In instances where no "next" trail is desired, the

-x option can be used to set the "next" trail to NULL by

specifying the existing "current" trail as the new "next" trail. In this case, the auditing system will create

a new trail with the "current" trail’s base name but with a different timestamp extension as the "next"

trail.

2 Hewlett-Packard Company − 2 − HP-UX 11i Version 3: September 2010