auditd(8) on Solnix vs Linux and the BSDs
On Solnix, auditd is the illumos audit daemon at /usr/sbin/auditd. It takes no options and is configured through smf(7) and auditconfig(8). FreeBSD's auditd takes -d and -l and is described in terms of audit_control(5) and audit(8). The bundle has no Linux, OpenBSD or NetBSD counterpart page.
The manual pages
- Solnix: auditd(8) from
pkgs.solnix.illumos-world-man· illumos.org - FreeBSD: auditd(8) 15.1-RELEASE
What Solnix runs
A default Solnix system runs the illumos auditd at /usr/sbin/auditd. No other variants are shipped. It runs as the SMF service svc:/system/auditd. The audit(8) command is the preferred way to control it, and svcs(1) shows its status. The bundle includes only a FreeBSD counterpart, so nothing here is compared with Linux, OpenBSD or NetBSD.
Differences
| Compared with | Topic | What differs |
|---|---|---|
| FreeBSD | command-line options | Solnix auditd has no options: its synopsis is just /usr/sbin/auditd. FreeBSD auditd accepts -d (debug mode, does not daemonize) and -l (for on-demand start under launchd(8)). A FreeBSD invocation using -d has no Solnix equivalent in the page.Source: Solnix auditd(8) SYNOPSIS; FreeBSD auditd(8) SYNOPSIS, -d, -l |
| FreeBSD | where configuration lives | Solnix auditd takes its configuration from smf(7), managed with auditconfig(8). FreeBSD refers to audit_control(5) for the policy flags ahlt and cnt, so there is no audit_control file to edit on Solnix according to the page. Source: Solnix auditd(8) DESCRIPTION; FreeBSD auditd(8) COMPATIBILITY, SEE ALSO |
| FreeBSD | service management | On Solnix, auditd is the SMF service svc:/system/auditd. Query it with svcs(1) and manage it with svcadm(8), though audit(8) is preferred. The FreeBSD page names no service framework except launchd(8) for -l.Source: Solnix auditd(8) NOTES; FreeBSD auditd(8) -l |
| FreeBSD | controlling the daemon with audit(8) | Solnix audit(8) can make auditd start a new audit file, reread its configuration and open a new file, or close the trail and terminate auditing. audit -s starts auditd in a zone. The FreeBSD page says only that auditd responds to audit(8) requests.Source: Solnix auditd(8) DESCRIPTION, NOTES; FreeBSD auditd(8) DESCRIPTION |
| FreeBSD | zones and perzone policy | With the audit policy perzone, Solnix auditd runs in each zone and starts when the zone boots. A local zone reads audit_class and audit_event from its own /etc/security. The FreeBSD page does not mention zones.Source: Solnix auditd(8) NOTES; FreeBSD auditd(8) (no zone text) |
| FreeBSD | audit_warn conditions | The Solnix page documents when auditd runs audit_warn(8), with the arguments soft, allsoft, hard, allhard, tmpfile, nostart and auditoff. The FreeBSD page only lists audit_warn(5) in SEE ALSO and does not describe the conditions. Source: Solnix auditd(8) Auditing Conditions; FreeBSD auditd(8) SEE ALSO |
| FreeBSD | effect of configuration changes | On Solnix, configuration changes do not affect running audit sessions, because the process preselection mask is unchanged. Use auditconfig -setpmask on a running process, or log out and back in. The FreeBSD page does not say.Source: Solnix auditd(8) NOTES; FreeBSD auditd(8) DESCRIPTION |
| FreeBSD | audit review group | FreeBSD lets you create an optional group "audit" whose non-privileged members may read the audit trail files. The Solnix page does not mention such a group. Source: FreeBSD auditd(8) DESCRIPTION; Solnix auditd(8) (no such text) |
| FreeBSD | removed -h and -s flags | FreeBSD says the historical -h and -s flags are now the audit_control(5) policy flags ahlt and cnt. The Solnix auditd takes no arguments at all, and its page does not name those policy flags.Source: FreeBSD auditd(8) COMPATIBILITY; Solnix auditd(8) SYNOPSIS |
Standards
- POSIX: auditd is not a POSIX.1-2024 utility.
- Solnix: Interface Stability: Committed.
Writing portable scripts
- Do not pass options to auditd in scripts. Solnix accepts none, and FreeBSD's
-dand-lare FreeBSD-specific. Use audit(8) to control the daemon on both. - Do not assume a configuration file. On Solnix, change audit settings with auditconfig(8), which stores them in smf(7).
Every difference here is taken from the manual pages linked above: Solnix's published page, Linux (man-pages and the GNU and util-linux manuals), FreeBSD, OpenBSD and NetBSD. Each row names its source. Where a manual is silent, this page is too. Compiled 2026-10-26. Found a mistake? Mail hackers@lists.solnix.io.