Starting and stopping the audit subsystem

After specifying the events to be recorded and the characteristics of the log file, you are ready to start auditing. You can start and stop auditing at any time, from the command line, using the auditon(ADM) and auditoff(ADM) commands. You can also arrange for auditing to start and stop automatically when the system boots and is shut down, using the /etc/init.d/audit file.