AUDIT_CONTROL(5)

NAME
audit_control - contains audit system parameters

DESCRIPTION
The audit_control file contains several audit system parameters. Each line of this file is of the form parameter:value. The parameters are:

dir The directory where audit log files are stored. There may be more than one of these entries. Changes to this entry can only be enacted by restarting the audit system. See audit(1) for a description of how to restart the audit system.

flags
    Specifies which audit event classes are audited for all users. audit_user(5) describes how to audit events for individual users. See the information below for the format of the audit flags.

naflags
    Contains the audit flags that define what classes of events are audited when an action cannot be attributed to a specific user.

minfree
    The minimum free space required on the file system audit logs are being written to. When the free space falls below this limit a warning will be issued. Not currently used as the value of 20 percent is chosen by the kernel.

AUDIT FLAGS
Audit flags are a comma delimited list of audit classes as defined in the audit_class file. (See audit_class(5) for details.) Event classes may be preceded by a prefix which changes their interpretation. The following prefixes may be used for each class:
+   Record successful events
-   Record failed events
^   Record both successful and failed events
^+  Don't record successful events
^-  Don't record failed events

DEFAULT
The following settings appear in the default audit_control file:

    dir:/var/audit
    flags:lo,ad,-all,^-fc,^-cl
    minfree:20
    naflags:lo

The flags parameter above specifies the system-wide mask corresponding to login/logout events, administrative events, and all failures except for failures in creating or closing files.

FILES
/etc/security/audit_control

SEE ALSO
audit(1), auditd(8), audit_class(5), audit_user(5)