Auditing a Trusted System

Auditing a trusted system is very similar to auditing a system that has not been converted to trusted mode. See Chapter 10 for the information on auditing. The only difference is how to select audited users. On a system that has not been converted to trusted mode, the userdbset command is used to specify those users who are to be audited. See userbdset(1M) and userdb(4). The associated attribute is called AUDIT_FLAG and is described in security(4). On a trusted system, the audusr command specifies those users who are to be audited. See audusr(1M) for more information.