Events generated by trusted application software outside the kernel range from 2048 to 65535. The event names begin with AUE_, followed by a lowercase mnemonic for the event. The file /etc/security/audit_event lists individual events in numerical order. For a listing of events by class, see Appendix A, Event-to-Class Mappings. The following table shows general categories of user-related events.
Table 1–1 Audit Event Categories
Number Range |
Type of Event |
---|---|
2048–65535 |
User-level audit events |
2048–32767 |
Reserved for Solaris and Trusted Solaris user-level programs |
32768–65536 |
Available for third-party applications |