/etc/default/audit

This file may contain the following parameters that control auditing:

AUDIT_PGM

Program that will be executed if there is a log switch.

AUDIT_NODE

Node name to be appended to the audit event filename.

AUDIT_DEFPATH

Pathname of the directory for audit event log files. The value for this parameter in the distributed system is /var/audit.

AUDIT_LOGERR

Action taken if there is a write error to the audit event log file. The allowable values are DISABLE, which disables the auditing subsystem, and SHUTDOWN, which shuts the computer system down to firmware mode. The value for this parameter in the distributed system is SHUTDOWN.

AUDIT_LOGFULL

Action taken when the audit event log file becomes full. The allowable values are DISABLE, which disables the auditing subsystem, SHUTDOWN, which shuts the computer system down to firmware mode, and SWITCH, which switches to an alternate event log file. The value for this parameter in the distributed system is SHUTDOWN.