Nathan Dietsch wrote: > Hello Darren, > >> Not today but I believe their should be. However it doesn't really >> make sense until we have the "always on audit" project done because >> some SMF services would start too early. >> >> Traditionally system processes started by init/rc were not subject to >> audit but in the brave new world of SMF and always on audit I think we >> have some great scope for doing more here. >> > > Can you provide a pointer to the "always on" audit project? By always > on, do you mean turning it on early in the boot process or do you mean > that is is on by default. Changing to have auditing on by default would > make the job of selling the benefits a lot easier. Enabling a sensible > level of auditing by default (that could be tuned to be more verbose if > neccessary) would be a really good idea.
http://opensolaris.org/os/project/audit/ Specifically: http://opensolaris.org/os/project/audit/projects/always-on/ -- Darren J Moffat
