Safeguard Audit Service Manual (G06.29+, H06.08+, J06.03+)

Specifying Auditing
Safeguard Audit Service Manual — 520480-031
2 - 30
Systemwide Disk-File Auditing
AUDIT-DEVICE-ACCESS-FAIL
specifies conditions for auditing unsuccessful attempts to access any device or
subdevice on the system. This setting supplements individual device or subdevice
audit settings. The conditions can be ALL, NONE, LOCAL, or REMOTE. The default is
NONE.
If client auditing is enabled, this attribute also controls auditing for unsuccessful
file-system operations pertaining to devices and subdevices.
AUDIT-DEVICE-MANAGE-PASS
specifies conditions for auditing successful attempts to create or manage the
authorization record for any device or subdevice on the system. This setting
supplements individual device or subdevice audit settings. The conditions can be
ALL, NONE, LOCAL, or REMOTE. The default is NONE.
AUDIT-DEVICE-MANAGE-FAIL
specifies conditions for auditing unsuccessful attempts to create or manage the
authorization record for any device or subdevice on the system. This setting
supplements individual device or subdevice audit settings. The conditions can be
ALL, NONE, LOCAL, or REMOTE. The default is NONE.
To change any of these values, issue the ALTER SAFEGUARD command from
SAFECOM. For example, to specify auditing of successful attempts to access any
device or subdevice, regardless of the audit settings in the individual device or
subdevice authorization record, issue this command:
=ALTER SAFEGUARD, AUDIT-DEVICE-ACCESS-PASS ALL
Systemwide Disk-File Auditing
You can configure systemwide auditing of all disk volumes, subvolumes, and files,
regardless of individual authorization records. These objects can be audited at the
LOCAL level, the REMOTE level, or both levels (ALL).
This configuration attributes control systemwide auditing of disk files:
AUDIT-DISKFILE-ACCESS-PASS
specifies conditions for auditing successful attempt
s to access any volume,
subvolume, or disk file on the system. This setting supplements the individual audit
settings. The conditions can be ALL, NONE, LOCAL, or REMOTE. The default is
NONE.
If client auditing is enabled, this attribute also controls auditing for successful
file-system operations pertaining to volumes, subvolumes, and disk files.