Honored Contributor Honored Contributor
Re: /.secure/etc/audnames and /etc/audit/audnames

Doubtful.  The more likely have to do with system function auditing.  

 

The /etc/audit/audnames appears to define the audit files to use, though this can also be set in /etc/rc.config.d/auditing..

 

From an 11.31 system:

 

# pwd
/etc/audit
atl5par0-11.31 root etc/audit # cat audnames
/var/.audit/audfile1,1000
/var/.audit/audfile2,1000
1