Using Solaris Auditing in Zones
Solaris auditing is described in Chapter 28, Solaris Auditing (Overview), in System Administration Guide: Security Services. For zones considerations associated with auditing, see
the following sections:
An audit record describes an event, such as logging in to a
system or writing to a file. The record is composed of tokens, which
are sets of audit data. By using the zonename token, you can configure
Solaris auditing to identify audit events by zone. Use of the zonename token allows
you to produce the following information:
Configuring Audit in the Global Zone
Solaris audit trails are configured in the global zone. Audit policy is set
in the global zone and applies to processes in all zones. The
audit records can be marked with the name of the zone in which
the event occurred. To include zone names in audit records, you must edit
the /etc/security/audit_startup file before you install any non-global zones. The zone name
selection is case-sensitive.
To configure auditing in the global zone to include all zone audit
records, add this line to the /etc/security/audit_startup file:
/usr/sbin/auditconfig -setpolicy +zonename
As the global administrator in the global zone, execute the auditconfig utility:
global# auditconfig -setpolicy +zonename
For additional information, see the audit_startup(1M) and auditconfig(1M) man pages and “Configuring
Audit Files (Task Map)” in System Administration Guide: Security Services.
Configuring User Audit Characteristics in a Non-Global Zone
When a non-global zone is installed, the audit_control file and the audit_user file
in the global zone are copied to the zone's /etc/security directory. These files
might require modification to reflect the zone's audit needs.
For example, each zone can be configured to audit some users differently from
others. To apply different per-user preselection criteria, both the audit_control and the
audit_user files must be edited. The audit_user file in the non-global zone might also
require revisions to reflect the user base for the zone if necessary. Because
each zone can be configured differently with regard to auditing users, it is
possible for the audit_user file to be empty.
For additional information, see the audit_control(4) and audit_user(4) man pages.
Providing Audit Records for a Specific Non-Global Zone
By including the zonename token as described in Configuring Audit in the Global Zone, Solaris audit records can
be categorized by zone. Records from different zones can then be collected by
using the auditreduce command to create logs for a specific zone.
For more information, see the audit_startup(1M) and auditreduce(1M) man pages.