Destination and filtering of audit log data

Audit log data is output to syslog. Because HDLM messages other than audit log data are also output to syslog, we recommend that you specify the output destination that is used exclusively for audit log data.

For example, when you are using syslogd to change the output destination of audit log data to /usr/local/audlog, specify the following two settings:

• Specify the following setting in the /etc/syslog.conf file:

  local0.info /usr/local/audlog

• Use the HDLM command's set operation to specify local0 for the audit log facility:

You can also filter the audit log output by specifying a severity level and type for the HDLM command's set operation.

Filtering by severity:

The following table lists the severity levels that can be specified.

Filtering by category:

The following categories can be specified:

• StartStop

• Authentication

• ConfigurationAccess

• All of the above

For details on how to specify audit log settings, see Setting up the HDLM functions.