Solaris BSM audit log

UNIX Solaris
1

I got a lot of this message in my /var/audit log

how can I exclude this message?

header,127,2,invalid event number,fe,hostsol1.com.sg,2007-12-21 00:10:01.001 +08:00,argument,1,0x5,processor ID,argument
,2,0x3,flag,text,P_STATUS,subject,zhang1,root,root,root,root,18228,576129155,291 131094 10.88.95.158,return,failure: Invalid
argument,-1

2

If you want to exclude a specific audit event from the audit trail you have two choises:

  • don't audit the class which the event belongs to
  • edit /etc/security/audit_event and remove the event class