Setting audit criteria with the auditset command

The first step in setting audit criteria is for the administrator to decide which events to audit. ``Auditable events'' provides a description of the auditable events along with guidelines for determining which events to audit.

The auditset command provides the ability to set and display the audit criteria. You may display

• the system audit criteria (-d option)

• the user audit criteria for all active users (-d and -a options)

• the user audit criteria for one or more specific active users (-d and -u options)

• the system audit criteria (-s option)

• the user audit criteria for all active users (-e and -a options)

• the user audit criteria for one or more specific active users (-e and -u options)