How to Change Which Events Are
in Which Audit Classes
This procedure describes how to modify the default event to class mappings.
-
Edit the /etc/security/audit_event file to change the class
mapping for each event to be changed.
-
Reboot the system or run auditconfig -conf to change the
runtime kernel event-to-class mappings.