Overview of auditable event types and classes
An auditable event type (also referred to as an event)
represents a single action (either a command or system call)
that may affect the security of the system.
There are two types of events:
Fixed events are always audited when the auditing subsystem
is enabled and can not be altered.
The fixed events represent actions that must be recorded to ensure the
integrity and accuracy of the data in the audit event log file
(also referred to as the log file).
Recording only the fixed events will not give you a complete record of
all actions that affect system security.
are audited only if you select
them for auditing.
you can tailor the information recorded to meet the needs of
When you decide which events to record, you are pre-selecting the
That is, the events are being selected for recording in the audit event log
file before they happen.
When you decide which events to report, you are post-selecting
That is, you are selecting which events will be reported out of all
the ones that have been recorded.
if you did not pre-select an event,
the audit event log file will not contain any record for that event type.
gives complete information on all events valid for this release.
``Summary of auditable events and classes''
lists all events recognized by the subsystem, including obsolete
events and events that are valid only for specific earlier releases.
The default audit event mask contains only the fixed event types.
Managing the audit event log file
Writing audit data
© 2005 The SCO Group, Inc. All rights reserved.
SCO OpenServer Release 6.0.0 -- 03 June 2005