'\" te
.\" Copyright (c) 2017 Peter Tribble
.\"  Copyright (c) 2009, Sun Microsystems, Inc. All Rights Reserved
.\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License. You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.
.\"  See the License for the specific language governing permissions and limitations under the License. When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with
.\" the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
.TH AUDIT_BINFILE 7 "Mar 6, 2017"
.SH NAME
audit_binfile \- generation of audit logs
.SH SYNOPSIS
.LP
.nf
\fB/usr/lib/security/audit_binfile.so\fR
.fi

.SH DESCRIPTION
.LP
The \fBaudit_binfile\fR plugin module for audit,
\fB/usr/lib/security/audit_binfile.so\fR, writes binary audit data to files as
specified in the plugin's attributes configured by \fBauditconfig\fR(8); it
is the default plugin for the audit daemon \fBauditd\fR(8). Its output is
described by \fBaudit.log\fR(5).
.SH OBJECT ATTRIBUTES
.LP
The \fBp_dir\fR attribute specifies a comma-separated list of
directories to be used for storing audit files.
.sp
.LP
The \fBp_minfree\fR attribute specifies the percentage of free space required.
If free space falls below this threshold, the audit daemon \fBauditd\fR(8)
invokes the shell script \fBaudit_warn\fR(8). The default threshold is 0%.
.sp
.LP
The \fBp_fsize\fR attribute defines the maximum size in bytes that an audit
file can become before it is automatically closed and a new audit file opened.
This is equivalent to an administrator issuing an \fBaudit\fR \fB-n\fR command
when the audit file contains the specified number of bytes. The default size is
zero (0), which allows the file to grow without bound. The value specified must
be within the range of [512,000, 2,147,483,647].
.SH EXAMPLES
.LP
The following commands cause \fBaudit_binfile.so\fR to be activated, specify the
directories for writing audit logs, and specify the percentage of required free
space per directory. Note that using \fBauditconfig\fR(8) only allows one
attribute to be set at a time.
.sp
.in +2
.nf
# auditconfig -setplugin audit_binfile active p_minfree=20
# auditconfig -setplugin audit_binfile active \e
p_dir=/var/audit/jedgar/eggplant,\e
/var/audit/jedgar.aux/eggplant,\e
/var/audit/global/eggplant
.fi
.in -2
.sp

.SH ATTRIBUTES
.LP
See \fBattributes\fR(7) for a description of the following attributes:
.sp

.sp
.TS
box;
c | c
l | l .
ATTRIBUTE TYPE	ATTRIBUTE VALUE
_
MT Level	MT-Safe
_
Interface Stability	Committed
.TE

.SH SEE ALSO
.LP
.BR audit.log (5),
.BR attributes (7),
.BR auditconfig (8),
.BR auditd (8)