audeventstab(4) audeventstab(4)
NAME [Toc] [Back]
audeventstab - define and describe audit system events
DESCRIPTION [Toc] [Back]
The /usr/audit/audeventstab file lists audit event numbers,
corresponding mnemonic names, and brief explanations of each event.
Blank lines and comments (beginning with a # character) are allowed.
Each non-comment, non-blank line in this file contains three parts:
event Audit event number in decimal: a single field
separated by whitespace.
name Corresponding mnemonic name: a single field
separated by whitespace.
explanation Remainder of the line, following a # character.
For kernel-generated audit events, event numbers match kernel-internal
system call numbers, and event names are system call names. For
events from self-auditing programs, names are macros defined in
<sys/audit.h>.
EXAMPLES [Toc] [Back]
To extract a list of event numbers and names from the file by
stripping comments and ignoring blank lines:
tab=' '
sed < /usr/audit/audeventstab -e 's/#.*//' -e "/^[ $tab]*$/d"
AUTHOR [Toc] [Back]
audeventstab was developed by HP.
FILES [Toc] [Back]
/usr/audit/audeventstab
SEE ALSO [Toc] [Back]
audisp(1M), audevent(1M).
Hewlett-Packard Company - 1 - HP-UX 11i Version 2: August 2003 [ Back ] |
