WebSphere allows you to configure what will happen if a failure occurs with the audit subsystem. By default, "Audit subsystem failure action" is set to No warning. The other options are Log warning or Terminate server.

You can have an email sent if the audit subsystem has a failure. First, you will need to enter the target email address and SMTP server.

1. In the left panel of the WebSphere web console, expand Security and select Security auditing.
2. Select Audit monitor.
3. Select New.
4. Check Message log and Email sent to nofication list, give the new entry a name, add a destination email address and SMTP server, and select OK.
5. Select Save.

In this example, an email will be sent to john.doe@example.com.

Next, you will enable audit monitoring.

1. In the WebSphere admin console, expand Security and select Security auditing.
2. Select Audit monitor.
3. Check Enable monitoring and select the monitor you created.
4. Select OK.
5. Select Save.

In this example, the testingNotification monitor is enabled, meaning that configuration to send an email to john.doe@example.com when the audit system has a failure is enabled.