AIX auditing config files 1

[absi]

hello All
I want to know what are the main AIX auditing cofigutration files???
I 'll appreciate any help.

Absi [sig][/sig]

 

[shiraz]

hi
your required files are present in /etc/security/audit directory.
These are
1.config fie:contains audit subsystem configuration
2.events file:contains audit events info
3.objects file :conatins info about audited objects(files)
hope this info will work

Regds

Shiraz [sig][/sig]

 

[talam]

can we audit "who deleted a file" from audit? Is this it?

unlink - FILE_Unlink - Removes a file system object.

Auditing object seems to give RWX on all users.

Please advise if anyone had audited user's activity at this level/event.