Hello Friends,
I had enabled the audit and configured for sysadmin user alone in audit config file. But the audit starts logging for root user alone.

I want the audit to record only for sysadmin activities...

Need your expertise and help in solving the issue.

Attached the conf file below

start:
binmode = on
streammode = off

bin:
trail = /audit/trail
bin1 = /audit/bin1
bin2 = /audit/bin2
binsize = 10240
cmds = /etc/security/audit/bincmds
freespace = 65536

classes:
files = FILE_Write,FILE_Unlink,FILE_Rename,FILE_Owner,FILE _Mode,FILE_Acl,FILE_Privilege,DEV_Create

users:
sysadmin = files