NOTE: Make sure that /var/adm/btmp exists. For 10.20 and earlier, root must create this file, and for security reasons, it must be 600 permissions (never readable by users). To turn on audit features, the system will be converted to a Trusted system which includes a shadow password, password history and many other user controls.
Auditing can include a huge number items (see SAM for the choices) which will create very large log files very quickly. The default location for the logfiles is the / filesystem, a very bad location for fast growing files, so tell SAM to place the auditing files in /var/adm.
One other note is that on a busy system, auditing system calls can create a significant additional load on the system.
Bill Hassell, sysadmin
