System Auditing

Hi

I'm hoping someone will be able to help me here.

I'm running Solaris 10 i386 (Virtually - i.e using VMWare). I'm trying to enable and test System Auditing.

My questions:

- Do I need Trusted Solaris (TSOL) or does Solaris 10 come with TSOL modules enabled.

- Will it be possible to run Auditing on a Virtual OS since it is running on VMware.

I've also looked at all the documentation available and my configuration files seem to be fine but everytime I try to start the auditd deamon it fails with the following error:

- "audit failed to start because it cannot read or write the system's audit state"

When I try to use the auditconfig command, I get the following error:

- "auditon(2) failed, error = Invalid argument (22)" [ this is even when I use the correct arguments (eg auditconfig -getcond)

And I haven't been able to get it to start at system startup either.

Thanks

Sandile

[1008 byte] By [Sandile] at [2007-11-25 23:04:38]