Starting and stopping the UNIX agent
In most cases, the UNIX agent is automatically started when an audited computer is first powered on and remains running until the audited computer is shut down. Starting the agent when a computer starts up ensures the agent can capture activity for all shell sessions.
Although you typically start and stop the
dad process as part of a computer’s startup and shutdown scripts, you can also start the agent directly from the command line on a local computer.