Configuring auditing

Starting auditing from the command line

To enable auditing, use the auditon command, as follows:

auditon

Once auditing has been successfully started the following message is displayed:

   Auditing enabled /var/audit/filename

If you invoke auditon when auditing is already enabled, the following message is displayed:

   Auditing already enabled

While auditing is enabled, the auditing subsystem writes an audit record to the audit event log file each time auditon is invoked.