aud(8dce)
A dcecp object that manages the audit daemon on a DCE host
Synopsis
aud disable [remote_audit_daemon_name]
aud enable [remote_audit_daemon_name]
aud help
[operation | -verbose]
aud modify {-change attribute_list | attribute options}
[remote_audit_daemon_name]
aud operations
aud rewind [remote_audit_daemon_name]
aud show [remote_audit_daemon_name] [-attributes]
aud stop [remote_audit_daemon_name]
Arguments
operation
The name of one specific aud operation (subcommand) about which you want to see help information
remote_audit_daemon_name
By default, operations pertain to the local audit daemon. The optional argument remote_audit_daemon_name specifies the name or the binding of
one remote audit daemon to operate on. The name syntax is:
/.../cellname/hosts/hostname/auditd
A remote audit daemon can also be specified with a string binding for the remote host on which the audit daemon is running. Use a string binding such as
ncacn_ip_tcp:130.105.1.227[endpoint]
or
obj-uuid@ncacn_ip_tcp:130.105.1.227
Alternatively, you can specify the binding using dcecp string syntax such as:
{ncacn_ip_tcp 130.105.1.227 1234}
{255d2a20-df66-11cd-a9f7-0000c03adf56 ncadg_ip_udp 130.105.5.92}
Description
The aud object represents the audit daemon (called auditd in the reference implementation) on a host. The daemon creates audit trails on a single
host. The administrative functions are limited to changing the state of the daemon (enabled, disabled, stopped), and changing the strategy used to deal with file system storage for the audit trails.
This command operates on the audit daemon on the local host, unless the _s(aud) convenience variable is set. If set, the value is taken to be the name of an audit daemon's server entry, as found in the DCE namespace, or as a string binding; and that audit daemon is contacted to service the requests. An argument can also be given to these commands whose value is the same as that of the _s(aud) convenience variable. The argument takes precedence over the convenience variable.
More: