Distributed security auditing subsystem for an operating system

The distributed auditing subsystem of claim 13, wherein said permanent audit trail file further comprises:

• a plurality of data frames organized with a header portion, a compressed bin portion, and a trailing portion;
• said header portion including the number of bytes in the compressed bin associated therewith and the identity of a client node which was the source of the audit information in said bin;
• said trailing portion including the number of bytes in said associated compressed bin and the identity of said client node;
• and
• said byte count in said header portion and said byte count in said trailing portion enabling said permanent audit trail file to be searched in either the forward or reverse direction.

A method for distributed, security auditing of events occurring in each of a plurality of client processors in a system and the compression of auditing information generated thereby in a server processor in the system, comprising the steps of:

• monitoring the occurrence of a defined set of events effecting data security of a first client processor in said system, with a first security audit daemon running in said first client processor;
• performing a remote mounting with said first client processor, of a security audit directory in a server processor in said system, containing first temporary bin files associated with said first client processor;
• writing first audit records with said first audit daemon in response to said events occurring in said first client processor, to said first temporary bin files in said remotely mounted security audit directory in said server processor;
• selectively compressing with said first audit daemon in said first client processor records in said first temporary bin files and writing resulting first compressed bins with a first type identifier to a permanent audit trail file in said remotely mounted security audit directory in said server processor;
• monitoring the occurrence of a defined set of events effecting data security of a second client processor in said system, with a second security audit daemon running in said second client processor;
• performing a remote mounting with said second client processor, of said security audit directory in said server processor in said system, containing second temporary bin files associated with said second client processor;
• writing second audit records with said second audit daemon in response to said events occurring in said second client processor, to said second temporary bin files in said remotely mounted security audit directory in said server processor;
• and
• selectively compressing with said second audit daemon in said second client processor records in said second temporary bin files and writing resulting second compressed bins with a second type identifier to said permanent audit trail file in said remotely mounted security audit directory in said server processor.