HP-UX Reference (11i v2 03/08) - 1M System Administration Commands A-M (vol 3)

a
audevent(1M) audevent(1M)
NAME
audevent - change or display event or system call audit status
SYNOPSIS
audevent [-P-p][-F
-f][-E][[-e event ] ... ] [-S
][[-s syscall ] ... ]
audevent [-l]
DESCRIPTION
audevent changes or displays the auditing status of the given events or system calls. The event is used
to specify names associated with certain self-auditing commands; syscall is used to select related system
calls.
If neither
-P, -p, -F
, nor -f is specified, the current status of the selected events or system calls is
displayed.
If the
-E option is supplied, it is redundant to specify events with the
-e option. This also applies to the
-S and -s options. If no event is specified, all events are selected. If no system call is specified, all sys-
tem calls associated with the selected events are selected.
audevent takes effect immediately. However, the events and system calls specified are audited only
when called by a user currently being audited (see audusr(1M)).
If
-l is specified, a list of valid events and their associated system calls (if any) are displayed. This
option may be helpful when deciding which -e or -s options to use.
Note: The set of audited system calls and corresponding audit events varies frequently as HP-UX
evolves. The system call name referred to by the auditing system usually matches the real system
call name, but with a few exceptions. Some important known exceptions are provided in System
Call Name Mapping Execptions .
Only the super-user can change or display audit status.
Options
audevent recognizes the following options and command-line arguments:
-P Audit successful events or system calls.
-p Do not audit successful events or system calls.
-F Audit failed events or system calls.
-f Do not audit failed events or system calls.
-E Select all events for change or display.
-e event Select event for change or display.
-S Select all system calls for change or display.
-s syscall Select syscall for change or display.
-l Display a list of valid events and their associated system calls. This option should
not be used with any other options.
The following is a list of the valid event types or categories:
create Object creation. For example, file creation, directory creation, and other object
creation.
delete Object deletion. For example, file deletion, directory deletion, and other object dele-
tion.
readdac Discretionary access control (DAC) information reading events.
moddac DAC modification events.
modaccess Non-DAC modification events.
open Object opening. For example, file open and other object open.
close Object closing. For example, file close and other object close.
process Process operations.
Section 1M−−48 Hewlett-Packard Company − 1 − HP-UX 11i Version 2: August 2003