SOLARIS
Instructions for forwarding Solaris logs to your Log Management device
PREREQUISITES
Solaris 11.X- To configure the audit_syslog plugin, you must become an administrator who is assigned the Audit Configuration rights profile
- To configure the syslog utility and create the auditlog file, you must assume the root role
- The IP Address for the Clone Systems Log Management device
1. Select audit classes to be sent to the audit_syslog plugin, and make the plugin active. Note: p_flags audit classes must be preselected as either system defaults or in the audit flags of a a user or a rights profile. Records are not collected for a class that is not preselected.
2. Configure the syslog utility.
3. Refresh the audit service. The audit service reads the changes to the audit plugin upon refresh.
4. Regularly archive the syslog log files. The audit service can generate extensive output. To manage the logs, see the logadm(1M) man page.
Example 4-11 Specifying Audit Classes for syslog Output
In the following example, the syslog utility collects a subset of the preselected audit classes. The pf class is created in Example 3–15.
The arguments to the auditconfig command instruct the system to collect all login/logout, non-attributable, and change of system state audit records. The audit_syslog plugin entry instructs the syslog utility to collect all logins, successful non-attributable events, and failed changes of system state. For the jdoe user, the binary utility collects successful and failed calls to the pfexec command. The syslog utility collects successful calls to the pfexec command.
Example 4-12 Putting syslog Audit Records on a Remote System
You can change the audit.notice entry in the syslog.conf file to point to a remote system. In this example, the name of the local system is sys1.1. The remote system is remote1.
