Configuring auditing

Stopping auditing from the command line

To stop the auditing subsystem, use the auditoff command, as follows:

auditoff

Once auditing has been successfully stopped the following message is displayed:

   Auditing disabled

If you invoke auditoff when auditing is already disabled, the following message is displayed:

   Auditing already disabled

The auditing subsystem writes an audit record to the audit event log file for the invocation of the auditoff command and then disables auditing. Any processes that are being audited but have not completed will not generate audit records.

NOTE: Auditing is an important component of a secure computer system. If you run your system with auditing disabled, it cannot be considered secure. You will not have a record of security related events for the time when the system was up but auditing was disabled.