This chapter focuses on the installation and configuration of event auditing.FreeBSD implements Sun's published Basic Security Module (BSM) Application Programming Interface (API) and file format, and is interoperable with the Solaris and Mac OS X audit implementations.How to review the audit trail using the audit reduction and review tools.

How to configure event auditing on FreeBSD for users and processes.Synopsis, the FreeBSD operating system includes support for security event auditing.It explains audit policies and provides an example audit configuration.

Before reading this chapter, you should: Warning: The audit facility has some known limitations.After reading this chapter, you will know: What event auditing is and how it works.