HP-UX Reference (11i v1 00/12) - 5 Miscellaneous Topics, 7 Device (Special) Files, 9 General Information, Index (vol 9)

ManualsBrandsHP ManualsSoftwareHP-UX Reference Manuals

__________________________________________________________________________________________________________________________________________________________________________________________________

STANDARD Printed by: Nora Chuang [nchuang] STANDARD

/build/1111/BRICK/man5/!!!intro.5

________________________________________________________________

___ ___

audit(5) audit(5)

moddac Log all modiﬁcations of object’s Discretionary access control (DAC) information includ-

ing acl(2), chmod(2), chown(2), fchmod(2), fchown(2), fsetacl(2), setacl(2), and

umask(2).

modaccess Log all modiﬁcations other than DAC, including chdir(2), chroot(2), link(2), lockf64(2),

newgrp(1), rename(2), setgid(2), setgroups(2), setresgid(2), setresuid(2), setuid(2),

shmctl(2), shmdt(2), and unlink(2).

open Log all openings of objects (ﬁle open, other objects’ open) including execv(2), execve(2),

ftruncate(2), ftruncate64(2), kload(2), ksem_open(2), lpsched(1M), mmap64(2),

mq_open(2), open(2), ptrace(2), shm_open(2), truncate(2), and truncate64(2).

close Log all closings of objects (ﬁle close, other objects’ close) including close(2),

ksem_close(2), and mq_close(2).

process Log all operations on processes, including exit(2), fork(2), kill(2), mlock(2), mlock-

all(2), munlock(2), munlockall(2), setcontext(2), setrlimit64(2), sigqueue(2),

ulimit64(2), and vfork(2).

removable Log all removable media events (mounting and unmounting events), including

mount(2), umount(2), and vfsmount(2).

admin Log all administrative and privileged events, including audevent(1M), audisp(1M),

audswitch(2), audsys(1M), audusr(1M), chfn(1), chsh(1), init(1M), passwd(1),

pwck(1M), reboot(2), sam(1M), setaudid(2), setaudproc(2), setdomainname(2),

setevent(2), sethostid(2), settimeofday(2), stime(2), and swapon(2).

ipccreat Log all IPC create events including socket(2) and bind(2).

ipcopen Log all IPC open events including connect(2) and accept(2).

ipcclose Log all IPC close events including shutdown(2).

uevent1 Log user-deﬁned event.

uevent2 Log user-deﬁned event.

uevent3 Log user-deﬁned event.

ipcdgram Log IPC Datagram transactions.

For a complete description of system call assignments to event types, see audevent(1M).

Note that some commands such as init(1M) may occur in more than one category because the event varies,

depending on the operation done by the command.

AUTHOR

The auditing system described above was developed by HP.