/etc/default/audit

This file may contain the following parameters that control auditing:

AUDIT_PGM

Program that will be executed if there is a log switch.

AUDIT_NODE

Node name to be appended to the audit event filename.

AUDIT_DEFPATH

Pathname of the directory for audit event log files. The value for this parameter in the distributed system is /var/audit.

AUDIT_LOGERR

Action taken if there is a write error to the audit event log file. The allowable values are ``DISABLE'', which disables the auditing subsystem, and ``SHUTDOWN'', which shuts the computer system down to firmware mode. The value for this parameter in the distributed system is ``SHUTDOWN''.

AUDIT_LOGFULL

Action taken when the audit event log file becomes full. The allowable values are ``DISABLE'', which disables the auditing subsystem, ``SHUTDOWN'', which shuts the computer system down to firmware mode, and ``SWITCH'', which switches to an alternate event log file. The value for this parameter in the distributed system is ``SHUTDOWN''.