audit subsystem

[dom kris]

How can I now if the audit subsystem is already in the kernel?
We are going to enable the auditing on our Tru64 systems but I have noticed that on some systems need to be rebooted. (I user standard sysman to activate auditing).
I would like to test before I execute the sysman procedure if the audit subsystem is in the kernel in order to better plan the interventions. (less supprises)

With kind regards,

Kris

[Ann Majeske · Accepted solution]

Check for the line
options DEC_AUDIT

in your /sys/conf/ file.

This doesn't guarantee that the system has audit enabled (i.e. it doesn't guarantee that you actually built and booted the vmunix after this file was changed), but it gets you pretty close.

Ann

[dom kris]

Thanks Ann!