HP-UX Reference (11i v3 07/02) - 1M System Administration Commands A-M (vol 3)

a
audevent(1M) audevent(1M)
NAME
audevent - change or display profile, event, or system call audit status
SYNOPSIS
audevent [-P  -p][-F
 -f][-r profile][-E][-e event]... [
-S][-s syscall]...
audevent [-l]
DESCRIPTION
audevent changes or displays the auditing status of the given profile, event categories, or system calls. A
list of pre-defined profiles, event categories, and system call names is given in
/etc/audit/audit.conf
. Any site-specific customizations must be added to
/etc/audit/audit_site.conf
. See audit.conf(4) for more details. A profile consists of a set of
operations (event categories, self-auditing events, and system calls) that affect a particular type of system.
An event category consists of a set of operations (self-auditing events and system calls) that affect a particu-
lar aspect of the system.
If neither
-P, -p, -F
, nor -f is specified, the current status of the selected profiles, event categories, or
system calls is displayed.
If the
-E option is supplied, it is redundant to use -e to specify particular events. This also applies in the
same way to the -S and -s options. If no event category is specified, all event categories associated with
the selected profile are selected. If no system call is specified, all system calls associated with the selected
profile and event categories are selected. At most one profile may be selected.
audevent takes effect immediately. However, the events and system calls specified are audited only
when called by a user currently being audited (see audit(5)).
If -l is specified, a list of valid profiles, event categories and system calls are displayed. This option may
be helpful when deciding which profile, event, or syscall to use with the -r
, -e,or-s options respectively.
The same information can also be found in
/etc/audit/audit.conf
(see audit.conf(4)).
Note: The set of audited system calls and corresponding audit events will change as HP-UX continues
to evolve.
Only a privileged user can change or display audit status.
Options
audevent recognizes the following options and command-line arguments:
-P Audit successful events or system calls.
-p Do not audit successful events or system calls.
-F Audit failed events or system calls.
-f Do not audit failed events or system calls.
-r profile Select profile to change or display.
-E Select all events to change or display.
-e event Select event to change or display. The event must be a valid event category (base
event or event alias) that is defined in /etc/audit/audit.conf or
/etc/audit/audit_site.conf.
-S Select all system calls to change or display.
-s syscall Select syscall to change or display. The syscall must be a valid system call name or
system call alias name that is defined in /etc/audit/audit.conf or
/etc/audit/audit_site.conf.
-l Display a list of valid profiles, event categories, and system calls. This option must
not be used with any other options.
The following is a list of the pre-defined event types or categories:
create Object creation. For example: file creation, directory creation, and other object crea-
tion.
delete Object deletion. For example: file deletion, directory deletion, and other object dele-
tion.
46 Hewlett-Packard Company − 1 − HP-UX 11i Version 3: February 2007