audit_event_defs(4M)       C2 Trusted DG/UX 5.4.2T      audit_event_defs(4M)


NAME
       auditeventdefs - audit event definitions

DESCRIPTION
       The file /etc/tcb/audit/auditeventdefs contains the event name,
       abbreviation, number for both kernel and non-kernel (command) events,
       and the class of each event.

       The auditeventdefs file has separate sections for kernel and non-
       kernel events.  The non-kernel event section begins with the line

              *Non-kernel map

       and the kernel event section begins with the line

              *Kernel map

       Each section is composed of entries that are position dependent and
       have the following format:

              name    abbrev    number    class

       Fields are separated by spaces or tabs and each entry is delimited by
       a newline.  Comment lines begin with #.  The entry fields are:


       name     This is the text string (or alias) used to uniquely identify
                the event.

       abbrev   This is a short name (abbreviation) for the event.  A - in
                this field indicates that no abbreviation is defined for
                this event.

       number   The event number.  Add 10,000 to these kernel event numbers
                to use them in selector value sets for audselect(1M).

       class    The class name of the event.  Class names are defined in
                auditmaskdefs(4M).

SEE ALSO
       audadmin(1M), audprint(1M), audselect(1M), auditmaskdefs(4M),
       auditaliasdefs(4M),

       Audit System Administrator's Guide for the C2 Trusted DG/UX System













Licensed material--property of copyright holder(s)                         1