Audit trail enabling

[mehul_3]

Hi there!
As per our latest security policy complied in our company, I need to implement Audit trail enable in HP-UX11i server.
Is there any implications like performance killer,rapid log generation etc if the same is ON?

Pl, required immediate help in this regard.
Thanks in advance

Regards,
Mehul

[Bill Costigan]

You have to be careful of what events you log. We took the default that the log files filled in no time.

Of couse the auditing companies never say what should be logged, just you need to log stuff.

We had to disable the calls to 'semop'
I'd log the least you can to pass the audit.

[generic_1 · Accepted solution]

Make sure you dont log to / or /var
You dont want to fill these up. Be sure you have some generaous space. Turn off as much stuff as allowed. If you turn this thing on fully you will glutin an average default size filesystem in no time :). It will take some resources. Look at the tools in glanceplus, to see how your system is doing healthwise.