auditevents(M)


auditevents -- Audit subsystem events

Description

The following Audit event names can be used in useradd(ADM) and usermod(ADM) commands to specify the auditMask for a user. They are displayed by the userls(ADM) command when user audit information is displayed.

These are the supported "fixed" events:

   add_grp                 audit_ctl               deactivate_lid
   add_usr                 audit_dmp               del_nm
   add_usr_grp             audit_evt               init
   assign_lid              audit_log               mod_grp
   assign_nm               audit_map               mod_usr
   audit_buf               date                    dev_audit

These are the supported "selectable" events.

   access                  ipc_acl                 set_grps
   acct_off                kill                    set_lvl_rng
   acct_on                 link                    set_pgrps
   acct_sw                 login                   set_sid
   bad_auth                lp_admin                set_uid
   bad_lvl                 lp_misc                 setrlimit
   cancel_job              misc                    shm_ctl
   chg_dir                 mk_dir                  shm_get
   chg_nm                  mk_mld                  shm_op
   chg_root                mk_node                 status
   chg_times               mount                   sym_create
   cov_chan_1              msg_ctl                 sym_status
   cov_chan_2              msg_get                 tfadmin
   cov_chan_3              msg_op                  trunc_lvl
   cov_chan_4              open_rd                 ulimit
   cov_chan_5              open_wr                 umount
   cov_chan_6              page_lvl                unlink
   cov_chan_7              passwd                  modpath
   cov_chan_8              pipe                    modadm
   create                  pm_denied               modload
   cron                    proc_lvl                moduload
   dac_mode                prt_job                 lwp_create
   dac_own_grp             prt_lvl                 lwp_bind
   def_lvl                 recvfd                  lwp_unbind
   disp_attr               rm_dir                  p_online
   exec                    sched_lk                logoff
   exit                    sched_fp                sched_fc
   fcntl                   sched_ts                lwp_exit
   file_acl                sem_ctl                 lwp_kill
   file_lvl                sem_get                 keyctl
   file_priv               sem_op                  stop_io
   fork                    set_attr                set_luid
   iocntl                  set_gid                 chg_priv

See also

auditmap(ADM)

Search the online documentation at localhost:8457 for "Auditable events" for descriptions of each audit event listed above.


© 2005 The SCO Group, Inc. All rights reserved.
SCO OpenServer Release 6.0.0 -- 03 June 2005