auditmap(ADM)

auditmap -- create and write audit map files

Synopsis

auditmap [-m dirname]

Description

The auditmap shell level command allows an administrator with the appropriate privileges to create and write the audit map files. The privileges required are audit, dacread, macwrite and setplevel. The auditmap command is invoked from the auditon command and may also be directly invoked by the auditing administrator.

The default directory for the audit map file(s) is /var/audit/auditmap/. The -m option allows the user to choose a directory where the audit map file(s) will be stored. If the directory, dirname, does not exist or is not writable, an error message is displayed (see ``Diagnostics'').

In a base system, the auditmap command creates the auditmap file. This file contains file identification information and six maps:

file-identification: audit software version, timezone information, privilege mechanism information, system name, machine node name, operating system release and version, and machine type
all login names and their corresponding uids
all group names and their gids including multiple groups
all event type names and their corresponding event type numbers
all event classes and their corresponding event types
all privilege names and their corresponding numbers
all system call names and their corresponding numbers

If the audit map file(s) already exist, under the default directory or the -m specified directory, they will be renamed. The existing auditmap file will be prefixed with an o. The new audit map file will then be created.

File locking mechanisms are in place to prevent file corruption during concurrent invocations of auditmap.

Files

/var/audit/auditmap/auditmap
/etc/security/audit/classes

Diagnostics

On successful completion, the auditmap command exits with a value of zero (0). If there are errors, it exits with one of the following values and prints the corresponding error message:

1: usage auditmap [-m dirname]
Invalid command syntax.
3: system service not installed
The audit package is not installed.
4: Permission denied
Failure because of insufficient privilege.
5: Invalid full path or pathname dirname specified
The directory specified as an argument to the -m option does not exist.
5: filename is not writable
5: fcntl() failed
12: auditctl() failed ASTATUS
Failure occurred while retrieving auditing status.
24: malloc() failed
24: argvtostr() failed
27: function name failed, errno = error
Failure occurred while accessing level information.

The following warning messages may be printed:

resource name not written to audit map file file: The user, group, privilege, or class map was not created (for example, if the user information is incomplete or missing, the warning printed is: UID map not written to audit map file /var/audit/auditmap/auditmap)
Unable to create the auditmap file
filename file busy: Unable to place lock on file.
unable to rename file audit map file to audit map file: Unable to rename the local audit map file.
stat() failed

References

auditon(ADM), auditrpt(ADM)