Switch to SpeakEasy.net DSL

The Modular Manual Browser

Home Page
Manual: (HP-UX-11.11)
Apropos / Subsearch:
optional field

 audevent(1M)							audevent(1M)

      audevent - change or display event or system call audit status

      audevent [-P|-p] [-F|-f] [-E] [[-e event] ...] [-S] [[-s syscall] ...]

      audevent changes the auditing status of the given events or system
      calls.  The event is used to specify names associated with certain
      self-auditing commands; syscall is used to select related system

      If neither -P, -p, -F, nor -f is specified, the current status of the
      selected events or system calls is displayed.  If no events or system
      calls are specified, all events and system calls are selected.

      If the -E option is supplied, it is redundant to specify events with
      the -e option; this applies similarly to the -S and -s options.

      audevent takes effect immediately.  However, the events and system
      calls specified are audited only when called by a user currently being
      audited (see audusr(1M)).	 A list of valid events and associated
      syscalls is provided in audit(5).

      Only the super-user can change or display audit status.

      audevent recognizes the following options and command-line arguments:

	   -P		  Audit successful events or system calls.

	   -p		  Do not audit successful events or system calls.

	   -F		  Audit failed events or system calls.

	   -f		  Do not audit failed events or system calls.

	   -E		  Select all events for change or display.

	   -e event	  Select event for change or display.

	   -S		  Select all system calls for change or display.

	   -s syscall	  Select syscall for change or display.

      The following is a list of the valid events and the associated
      syscalls (if any):

	   create	  Object creation (creat(), mkdir(), mknod(),
			  msgget(), pipe(), semget(), shmat(), shmget())

 Hewlett-Packard Company	    - 1 -   HP-UX Release 11i: November 2000

 audevent(1M)							audevent(1M)

	   delete	  Object deletion (ksem_unlink(), mq_unlink(),
			  msgctl(), rmdir(), semctl(), shm_unlink())

	   readdac	  Discretionary access control (DAC) information
			  reading (access(), fstat(), fstat64(),
			  getaccess(), lstat(), lstat64(), stat(), stat64)

	   moddac	  Discretionary access control (DAC) modification
			  (acl(), chmod(), chown(), fchmod(), fchown(),
			  fsetacl(), lchmod(), lchown(), putpmsg(), semop(),
			  setacl(), umask())

	   modaccess	  Non-DAC modification (chdir(), chroot(), link(),
			  lockf(), lockf64(), rename(), setgid(),
			  setgroups(), setpgid(), setpgrp(), setregid(),
			  setresgid(), setresuid(), setsid(), setuid(),
			  shmctl(), shmdt(), symlink(), unlink())

	   open		  Object opening (execv(), execve(), ftruncate(),
			  ftruncate64(), kload(), ksem_open(), mmap(),
			  mmap64(), mq_open(), open(), ptrace(), shm_open(),
			  truncate(), truncate64())

	   close	  Object closing (close(), ksem_close(), mq_close(),

	   process	  Process operations (exit(), fork(), kill(),
			  mlock(), mlockall(), munlock(), munlockall(),
			  nsp_init(), plock(), rtprio(), setcontext(),
			  setrlimit64(), sigqueue(), ulimit64(), vfork())

	   removable	  Removable media events  (exportfs(), mount(),
			  umount(), vfsmount())

	   login	  Logins and logouts

	   admin	  administrative and superuser events (acct(),
			  adjtime(), audctl(), audswitch(), clock_settime(),
			  mpctl(), reboot(), sched_setparam(),
			  sched_setscheduler(), serialize(), setaudid(),
			  setaudproc(), setdomainname(), setevent(),
			  sethostid(), setpriority(), setprivgrp(),
			  settimeofday(), stime(), swapon(), toolbox(),

	   ipccreat	  Interprocess Communication (IPC) object creation
			  (bind(), ipccreate(), ipcdest(), socket(),
			  socket2(), socketpair())

	   ipcopen	  IPC object opening (accept(), connect(),
			  fattach(), ipcconnect(), ipclookup(), ipcrecvcn())

 Hewlett-Packard Company	    - 2 -   HP-UX Release 11i: November 2000

 audevent(1M)							audevent(1M)

	   ipcclose	  IPC object deletion (fdetach(), ipcshutdown(),

	   ipcdgram	  IPC datagram (sendto() and recvfrom())

	   uevent1	  User-defined event 1

	   uevent2	  User-defined event 2

	   uevent3	  User-defined event 3

      All modifications made to the audit system are lost upon reboot.	To
      make the changes permanent, set AUDEVENT_ARGS1, AUDEVENT_ARGS2, or
      AUDEVENT_ARGS3 in /etc/rc.config.d/auditing.

      audevent was developed by HP.

      audisp(1M), audomon(1M), audsys(1M), audusr(1M), getevent(2),
      setevent(2), audit(4), audit(5).

 Hewlett-Packard Company	    - 3 -   HP-UX Release 11i: November 2000