auditcmd -- command interface for audit subsystem activation, termination, statistic retrieval, and subsystem notification


/tcb/bin/auditcmd [ -e ] [ -d ] [ -s ] [ -c ] [ -m ] [ -q ]


The auditcmd utility is used to control the audit subsystem. This command may only be executed by processes with the configaudit kernel privilege, since the audit device is used.

auditcmd allows the following options:

Enable the audit subsystem for audit record generation. The enabling of the audit subsystem initializes subsystem parameters from the /tcb/files/audit/audit_parms file. This file is established using the Audit manager selections or auditsh(ADM).

Inform the audit subsystem that a system shutdown is in progress. The subsystem continues audit record generation to a temporary directory on the root file system. The audit daemon is also modified so that it survives the shutdown. The subsystem continues to generate audit records until disabled.

Disable the audit subsystem. All audit record generation ceases and a termination record is written to the audit trail. This record results in the termination of the audit daemon. The subsystem properly synchronizes to ensure that the audit daemon has read all records from the audit trail before the system is allowed to terminate.

Inform the audit subsystem that multi-user run state has been achieved and that alternate audit directories specified by the administrator using the Audit manager or auditsh are now mounted and available.

Retrieve audit subsystem statistics from the audit device.

Perform the specified option silently. Do not report errors attributable to the audit subsystem not being enabled at the moment.

Exit values

auditcmd returns 0 on success, 1 on command line argument error, and -1 on failure actions. Reasons for failure include parameter file inconsistencies, lack of permission, and security database inconsistency.


Permission to use this utility requires the audit authorization in authorize(F).

See also


``Understanding the audit subsystem'' in the System Administration Guide

Standards conformance

auditcmd is not part of any currently supported standard; it is an extension of AT&T System V provided by The Santa Cruz Operation, Inc.
© 2003 Caldera International, Inc. All rights reserved.
SCO OpenServer Release 5.0.7 -- 11 February 2003