Configuring auditing

Stopping auditing from the command line

To stop the auditing subsystem, use the auditoff command, as follows:

auditoff

Once auditing has been successfully stopped the following message is displayed:

   Auditing disabled

If you invoke auditoff when auditing is already disabled, the following message is displayed:

   Auditing already disabled

The auditing subsystem writes an audit record to the audit event log file for the invocation of the auditoff command and then disables auditing. Any processes that are being audited but have not completed will not generate audit records.

NOTE: Auditing is an important component of a secure computer system. If you run your system with auditing disabled, it cannot be considered secure. You will not have a record of security related events for the time when the system was up but auditing was disabled.

Next topic: Starting the audit subsystem with /etc/init.d/audit
Previous topic: Starting auditing from the command line

© 2005 The SCO Group, Inc. All rights reserved.
SCO OpenServer Release 6.0.0 -- 03 June 2005