|HP-UX Reference > A
HP-UX 11i Version 3: February 2007
audevent — change or display profile, event, or system call audit status
audevent [-P | -p] [-F | -f] [-r profile] [-E] [-e event]... [-S] [-s syscall]...
audevent changes or displays the auditing status of the given profile, event categories, or system calls. A list of pre-defined profiles, event categories, and system call names is given in /etc/audit/audit.conf. Any site-specific customizations must be added to /etc/audit/audit_site.conf. See audit.conf(4) for more details. A profile consists of a set of operations (event categories, self-auditing events, and system calls) that affect a particular type of system. An event category consists of a set of operations (self-auditing events and system calls) that affect a particular aspect of the system.
If neither -P, -p, -F, nor -f is specified, the current status of the selected profiles, event categories, or system calls is displayed.
If the -E option is supplied, it is redundant to use -e to specify particular events. This also applies in the same way to the -S and -s options. If no event category is specified, all event categories associated with the selected profile are selected. If no system call is specified, all system calls associated with the selected profile and event categories are selected. At most one profile may be selected.
audevent takes effect immediately. However, the events and system calls specified are audited only when called by a user currently being audited (see audit(5)).
If -l is specified, a list of valid profiles, event categories and system calls are displayed. This option may be helpful when deciding which profile, event, or syscall to use with the -r, -e, or -s options respectively. The same information can also be found in /etc/audit/audit.conf (see audit.conf(4)).
Only a privileged user can change or display audit status.
audevent recognizes the following options and command-line arguments:
The following is a list of the pre-defined event types or categories:
Example 1: To display the list of valid profiles, event categories, and system calls as defined in file /etc/audit/audit.conf and /etc/audit/audit_site.conf, use:
# audevent -l
Example 2: To display the current audit event selection status, use:
The selection status for self-auditing events will be listed first, followed by the selection status for system calls.
Example 3: To audit all and only the events that are associated with profile basic for auditing, use:
# audevent -pfE; audevent -P -F -r basic
Example 4: To audit all bad login attempts, use:
# audevent -F -e login
Without doing a audevent -pfE first, this configuration will be made incremental to what has already been configured before.
All modifications made to the auditing system are lost upon reboot.
To make the changes permanent, set AUDEVENT_ARGS1, AUDEVENT_ARGS2, or AUDEVENT_ARGS3 in /etc/rc.config.d/auditing.