Safeguard Audit Service Manual (G06.24+, H06.03+)

Specifying Auditing
Safeguard Audit Service Manual—520480-014
2-23
Systemwide Auditing of All Objects
subprocess audit settings. The conditions can be ALL, NONE, LOCAL, or
REMOTE. The default is NONE.
If client auditing is enabled, this attribute also controls auditing for successful client
operations pertaining to processes and subprocesses.
AUDIT-PROCESS-ACCESS-FAIL
specifies conditions for auditing unsuccessful attempts to access any process or
subprocess on the system. This setting supplements individual process or
subprocess audit settings. The conditions can be ALL, NONE, LOCAL, or
REMOTE. The default is NONE.
If client auditing is enabled, this attribute also controls auditing for unsuccessful
client operations pertaining to processes and subprocesses.
AUDIT-PROCESS-MANAGE-PASS
specifies conditions for auditing successful attempts to create or manage the
authorization record for any process or subprocess on the system. This setting
supplements individual process or subprocess audit settings. The conditions can
be ALL, NONE, LOCAL, or REMOTE. The default is NONE.
AUDIT-PROCESS-MANAGE-FAIL
specifies conditions for auditing unsuccessful attempts to create or manage the
authorization record for any process or subprocess on the system. This setting
supplements individual process or subprocess audit settings. The conditions can
be ALL, NONE, LOCAL, or REMOTE. The default is NONE.
To change any of these values, issue the ALTER SAFEGUARD command from
SAFECOM. For example, to specify auditing of all successful attempts to access any
process or subprocess, regardless of the audit settings in the individual process or
subprocess authorization records:
=ALTER SAFEGUARD, AUDIT-PROCESS-ACCESS-PASS ALL
Systemwide Auditing of All Objects
You can collectively specify systemwide auditing for all of these types of objects:
•
Volumes, subvolumes, and disk files
•
Devices and subdevices
•
Processes and subprocesses
These configuration attributes control systemwide auditing for all the preceding types
of objects, regardless of individual authorization records: