NAME

audeventstab − define and describe audit system events

DESCRIPTION

The /etc/audeventstab file lists audit event numbers, corresponding mnemonic names, and brief explanations of each event.  Blank lines and comments (beginning with a # character) are allowed.  Each non-comment, non-blank line in this file contains three parts:

event Audit event number in decimal: a single field separated by whitespace. 

name Corresponding mnemonic name: a single field separated by whitespace. 

explanation Remainder of the line, following a # character. 

For kernel-generated audit events, event numbers match kernel-internal system call numbers, and event names are system call names.  For events from self-auditing programs, names are macros defined in <sys/audit.h>. 

EXAMPLES

To extract a list of event numbers and names from the file by stripping comments and ignoring blank lines:

tab=’’
sed < /etc/audeventstab -e ’s/#.∗//’ -e "/^[ $tab]∗$/d"

AUTHOR

audeventstab was developed by HP. 

FILES

/etc/audeventstab

SEE ALSO

audisp(1M), audevent(1M). 

Hewlett-Packard Company  —  HP-UX Release 9.03: April 1994