audevent(1M)audevent(1M)NAMEaudevent - change or display profile, event, or system call audit sta‐
tus
SYNOPSIS
profile] event]... syscall]...
DESCRIPTION
changes or displays the auditing status of the given profile, event
categories, or system calls. A list of pre-defined profiles, event
categories, and system call names is given in Any site-specific cus‐
tomizations must be added to See audit.conf(4) for more details. A
profile consists of a set of operations (event categories, self-audit‐
ing events, and system calls) that affect a particular type of system.
An event category consists of a set of operations (self-auditing events
and system calls) that affect a particular aspect of the system.
If neither nor is specified, the current status of the selected pro‐
files, event categories, or system calls is displayed.
If the option is supplied, it is redundant to use to specify particular
events. This also applies in the same way to the and options. If no
event category is specified, all event categories associated with the
selected profile are selected. If no system call is specified, all
system calls associated with the selected profile and event categories
are selected. At most one profile may be selected.
takes effect immediately. However, the events and system calls speci‐
fied are audited only when called by a user currently being audited
(see audit(5)).
If is specified, a list of valid profiles, event categories and system
calls are displayed. This option may be helpful when deciding which
profile, event, or syscall to use with the or options respectively. The
same information can also be found in (see audit.conf(4)).
Note: The set of audited system calls and corresponding audit
events will change as HP-UX continues to evolve.
Only a privileged user can change or display audit status.
Options
recognizes the following options and command-line arguments:
Audit successful events or system calls.
Do not audit successful events or system calls.
Audit failed events or system calls.
Do not audit failed events or system calls.
Select profile to change or display.
Select all events to change or display.
Select event to change or display. The event must be a
valid event category (base event or event alias)
that is defined in or
Select all system calls to change or display.
Select syscall to change or display. The syscall must
be a valid system call name or system call alias
name that is defined in or
Display a list of valid profiles, event categories, and system
calls.
This option must not be used with any other
options.
The following is a list of the pre-defined event types or categories:
Object creation.
For example: file creation, directory creation,
and other object creation.
Object deletion.
For example: file deletion, directory deletion,
and other object deletion.
Discretionary access control (DAC)
information reading events.
DAC modification events.
Non-DAC modification events.
Object opening.
For example: file open and other object open.
Object closing.
For example: file close and other object close.
Process operations.
Removable media events.
For example: mounting and unmounting events.
Login and logout events not related to any particular
system call.
All administrative and privileged events.
Interprocess Communication (IPC) object creation.
IPC object opening.
IPC object deletion.
IPC Datagram transactions.
User-defined event 1 (for self-auditing records).
User-defined event 2 (for self-auditing records).
User-defined event 3 (for self-auditing records).
EXAMPLES
Example 1: To display the list of valid profiles, event categories, and
system calls as defined in file and use:
Example 2: To display the current audit event selection status, use:
The selection status for self-auditing events will be listed first,
followed by the selection status for system calls.
Example 3: To audit all and only the events that are associated with
profile basic for auditing, use:
Example 4: To audit all bad login attempts, use:
Without doing a first, this configuration will be made incremental to
what has already been configured before.
WARNINGS
All modifications made to the auditing system are lost upon reboot.
To make the changes permanent, set or in
AUTHOR
was developed by HP.
FILES
File containing event mapping information
File containing site-specific event mapping information.
SEE ALSOaudisp(1M), audomon(1M), audsys(1M), audusr(1M), audit.conf(4),
audit(5).
audevent(1M)
