Man pages › Compared with Linux and the BSDs

`audit(8)` on Solnix vs Linux and the BSDs

On Solnix, audit is the illumos /usr/sbin/audit, which controls the audit daemon auditd(8) with -n, -s, -t and -v. The key differences from FreeBSD audit(8) are that Solnix has -v but no -e or -i, and that its configuration lives in smf(7), not in an audit control file.

The manual pages

Solnix: audit(8) from pkgs.solnix.illumos-world-man · illumos.org
FreeBSD: audit(8) 15.1-RELEASE

What Solnix runs

A default Solnix system runs the illumos audit at /usr/sbin/audit. No other variants are shipped. Configuration is stored in smf(7) and managed with auditconfig(8). Linux, OpenBSD and NetBSD pages are not in the bundle, so no comparison is made with them.

Differences

Compared with	Topic	What differs
FreeBSD	configuration source	Solnix audit reads its configuration from smf(7), managed with auditconfig(8). FreeBSD audit `-s` resynchronizes from the audit control file. Source: Solnix audit(8) DESCRIPTION; FreeBSD audit(8) -s
FreeBSD	`-v` validate option	Solnix has `-v`, which validates the audit service configuration without applying it. It requires at least one active plugin. The FreeBSD page documents no validate flag. Source: Solnix audit(8) -v; FreeBSD audit(8) SYNOPSIS
FreeBSD	`-e` missing	Solnix audit has no `-e`. FreeBSD `-e` removes expired audit log files immediately, without rotating the log. Source: Solnix audit(8) SYNOPSIS; FreeBSD audit(8) -e
FreeBSD	`-i` missing	Solnix audit has no `-i`. On FreeBSD, `-i` is documented as for Mac OS X only and needs auditd(8) run under launchd(8). Source: Solnix audit(8) SYNOPSIS; FreeBSD audit(8) -i
FreeBSD	`-s` behaviour	On Solnix, `-s` validates the configuration, tells auditd to reread it, and starts auditd if it is not running. On FreeBSD, `-s` resynchronizes and creates a new log file, and the daemon must already be running. Source: Solnix audit(8) -s; FreeBSD audit(8) -s, NOTES
FreeBSD	`-t` behaviour	On Solnix, `-t` closes the current trail file, disables auditing and stops the daemon; `-s` restarts it. On FreeBSD, `-t` terminates the audit system and renames closed log files to show the shutdown time. Source: Solnix audit(8) -t; FreeBSD audit(8) -t
FreeBSD	`-n` and expiry	Both systems close the current file and start a new one with `-n`. FreeBSD also removes log files that meet the expiration criteria in the audit control file. The Solnix page does not mention removal. Source: Solnix audit(8) -n; FreeBSD audit(8) -n
FreeBSD	zone restrictions	On Solnix, `-v` works in any zone. `-t`, `-s` and `-n` work only in local zones, and only if the perzone audit policy is set. The FreeBSD page describes no zone restriction. Source: Solnix audit(8) NOTES; FreeBSD audit(8) NOTES
FreeBSD	daemon prerequisite and privilege	FreeBSD says auditd must already be running and that audit administrator privileges are required. The Solnix page documents neither, though `-s` starts the daemon if it is not running. Source: FreeBSD audit(8) NOTES; Solnix audit(8) -s
FreeBSD	flag requirement	FreeBSD says one flag is required. The Solnix synopsis also shows one option, but the page does not say what happens with none. Source: FreeBSD audit(8) DESCRIPTION; Solnix audit(8) SYNOPSIS

Standards

POSIX: audit is not a POSIX.1-2024 utility.
Solnix: Stability: Evolving, from the ATTRIBUTES table.

Writing portable scripts

Use only -n, -s and -t in scripts that run on both Solnix and FreeBSD, and check the exit status. Avoid -e, -i and -v, which exist on only one side.
Keep configuration steps separate per system: auditconfig(8) and smf(7) on Solnix, the audit control file on FreeBSD.

Every difference here is taken from the manual pages linked above: Solnix's published page, Linux (man-pages and the GNU and util-linux manuals), FreeBSD, OpenBSD and NetBSD. Each row names its source. Where a manual is silent, this page is too. Compiled 2026-10-26. Found a mistake? Mail hackers@lists.solnix.io.