Oracle Solaris System Administration (MOSC)

MOSC Banner

Solaris 10 - How to audit only specific files

edited Jan 12, 2012 9:00PM in Oracle Solaris System Administration (MOSC) 2 commentsAnswered
I've implemented on solaris 10 the auditing.

I've enable the audit of the class:  lo,fw

It works well, I can access the result in /var/audit with the praudit command.

However I do not want to audit the file write events for all files on the file sytem.

I only want to audit: /etc/shadow and /etc/passwd. ..... Is there any way to do this.

I found a way to find out all events about /etc/shadow from teh /var/audit/* files..... but this not what i want.

I want that the audit only records events on some specific files or path ..... ?

Howdy, Stranger!

Log In

To view full details, sign in to My Oracle Support Community.

Register

Don't have a My Oracle Support Community account? Click here to get started.

Category Leaderboard

Top contributors this month

New to My Oracle Support Community? Visit our Welcome Center

MOSC Help Center