The signed audit log creates a log recording system events; the events that are recorded are selected from a list of potential events. This feature, when enabled, records all selected system events and produces a verbose set of messages about the activity. Be careful to provide enough space in the filesystem for this log when using signed audit logs. The signed audit log feature is disabled by default.

A log is set to a signed audit log by setting the logSigning parameter to enable and providing the nickname of the certificate used to sign the log.

When a log is set as a signed audit log, only a user with auditor privileges can access and view the log. Auditors can use the AuditVerify tool to verify that signed audit logs have not been tampered with.

If there is not a dedicated certificate to sign audit logs, the subsystem signing certificate can be used to sign logs. To do this for a Certificate Manager, specify caSigningCert cert-CA_instance name as the value in the signedAuditCertNickname parameter. For other systems, specify the appropriate signing certificate.

Which events are recorded in the log are configured by adding or deleting the event type from the value of the events parameter. Table 4.10, “Signed Audit Log Events” lists the loggable events. To add an event, add the logging event to the list; to delete an event, remove it from the list. Log events are separated by commas with no spaces.