Trusted Solaris Audit Administration

Previous: Appendix C Audit Reference


Numbers and Symbols

	- audit flag prefix ( )

	+ audit flag prefix ( )

	^- audit flag prefix ( )

	^+ audit flag prefix ( )


A

	aa audit class ( ) ( )

	aa audit flag ( )

	access audit record ( )

	acct audit record ( )

	acl token ( )

	ad audit flag ( )

	add_drv audit record ( )

	adjtime audit record ( )

	Admin Editor audit record ( )

	administrative roles, assuming ( )

	ahlt policy, flag ( )

	aliases, creating audit_warn mail alias ( )

	all
		audit flag ( )
			caution for using ( )
		in user audit fields ( )

	allhard string with audit_warn script ( ) ( )

	allocate audit record
		deallocate device ( )
		deallocate device failure ( )
		device allocate failure ( )
		device allocate success ( )
		list device failure ( )
		list device success ( )

	allsoft string with audit_warn script ( )

	always-audit flags
		described ( ) ( )
		process preselection mask ( )

	ao audit class ( ) ( )

	ao audit flag ( )

	ap audit class ( )

	ap audit flag ( )

	arbitrary token ( )

	arg token ( )

	arge policy, exec_env token and ( )

	argv policy, exec_args token and ( )

	as audit class ( )

	as audit flag ( )

	at audit record
		at-create crontab ( )
		at-delete atjob ( )
		at-permission ( )

	attr token ( )

	audit -n command ( )

	audit -s command
		preselection mask for existing processes ( )
		rereading audit files ( ) ( )
		resetting directory pointer ( )

	audit -t command ( )

	audit attributes
		See audit tokens

	audit audit record ( ) ( )

	audit classes
		adding ( )
		changing definitions ( )
		mapping events ( )
		overview ( ) ( )
		selecting for auditing ( )
		setting mappings for attributable events ( )
		setting mappings for non-attributable events ( )

	audit clients ( )

	audit_control file
		audit daemon rereading after editing ( )
		audit_user file modification ( )
		dir: line
			examples ( )
			files ( ) ( )
		dir: line described ( )
		examples ( )
		flags: line
			described ( )
			prefixes in ( )
			process preselection mask ( )
		minfree: line
			audit_warn condition ( )
			described ( )
		naflags: line ( )
		overview ( ) ( )
		prefixes in flags line ( )
		problem with contents ( )

	audit daemon
		audit_startup file ( )
		audit trail creation ( ) ( ) ( )
		audit_warn script
			conditions invoking ( ) ( )
			described ( ) ( ) ( )
		directories suitable to ( )
		enabling auditing ( )
		functions ( )
		order audit files are opened ( )
		rereading the audit_control file ( )
		starting ( )
		starting manually ( )

	audit_data file ( )

	audit directories
		creating ( )
		mounting ( )

	audit_event file
		overview ( ) ( )

	audit events
		audit_event file
			audit event type ( )
		audited by default ( )
		categories ( )
		finding in audit trail ( )
		including in audit trail ( )
		kernel events
			audit tokens ( )
			auditconfig command options ( )
			described ( )
		mapping to classes ( )
		non-attributable ( )
		numbers ( )
		numbers of system calls ( )
		overview ( ) ( )
		pseudo-events ( )
		record formats and ( )
		user-level events
			audit tokens ( )
			auditconfig command options ( )
			described ( )

	audit files
		/etc/security/audit_class file ( )
		/etc/security/audit_control file ( )
		/etc/security/audit_event file ( )
		/etc/security/audit_user file ( )
		/etc/security/audit_warn file ( )
		backup ( )
		cleaning up not_terminated file ( )
		combing selected ones ( )
		copying login/logout messages to single file ( ) ( )
		directory locations ( ) ( ) ( )
		displaying in entirety ( )
		managing ( )
		managing size of ( )
		merging ( )
		minimum free space for file systems ( )
		names
			closed files ( )
			examples ( )
			form ( ) ( )
			still-active files ( ) ( )
			time stamps ( )
			use ( )
		nonactive files marked not_terminated ( )
		order for opening ( )
		overflow prevention ( )
		printing ( ) ( ) ( )
		reading closed file ( )
		reading still-open file ( )
		reducing size ( )
		reducing storage space requirements ( ) ( )
		restoring ( )
		specifying location ( )
		switching to new file ( )
		time stamps ( )

	audit flags
		audit_control file line ( )
		audit_user file ( ) ( )
		changing dynamically ( )
		definitions ( )
		list of ( ) ( )
		machine-wide ( ) ( )
		overview ( )
		policy flags ( )
		prefixes ( )
		process preselection mask ( )
		syntax ( ) ( )

	audit IDs
		acquired at login ( )
		ensuring successful tracking ( )
		example audit record ( )

	audit log files
		See audit files

	audit mappings ( )

	audit partitions
		creating ( )
		removing free space ( )

	audit policies
		determining ( )
		setting ( ) ( )
		setting temporarily ( )

	audit records ( ) ( )
		adding sequence token ( )
		audit directories full ( ) ( )
		audit ID ( )
		audit session ID ( )
		converting to human-readable format ( ) ( )
		displaying by designated dates ( )
		displaying user activities ( )
		features in audit trail ( ) ( )
		format ( )
		format in audit trail ( ) ( )
		format or structure ( ) ( ) ( ) ( )
		human-readable format ( )
		kernel-level generated ( ) ( )
		login record ( ) ( )
		overview ( ) ( )
		policy flags ( )
		printing user activities ( )
		pseudo-events ( )
		reading ( )
		removing sequence token ( )
		selecting from audit trail ( )
		self-contained records ( )
		sending to a different file ( )
		time-stamp format ( )
		use of privilege ( )
		user-level generated ( ) ( )

	audit script ( ) ( )

	audit servers
		mount-point path names ( )
		partitioning example ( )
		planning ( )

	audit session ID ( ) ( )

	audit_startup file ( )

	audit tokens
		acl token ( )
		arbitrary token ( )
		arg token ( )
		attr token ( )
		audit record format ( ) ( ) ( ) ( )
		described ( )
		examples ( ) ( )
		clearance token ( )
		exec_args token ( )
		exec_env token ( )
		exit token ( ) ( ) ( )
		file token ( )
		groups token ( )
		header token ( ) ( ) ( ) ( )
		host token ( )
		in_addr token ( )
		ip token ( )
		ipc_perm token ( )
		ipc token ( ) ( ) ( )
		iport token ( )
		liaison token ( )
		newgroups token ( )
		opaque token ( )
		order ( )
		order in audit record ( )
		path token ( )
		policy flags ( )
		priv token ( )
		privilege token ( )
		process token ( )
		reading ( )
		return token ( ) ( )
		seq token ( )
		slabel token ( )
		socket-inet token ( )
		socket token ( ) ( )
		subject token ( )
		table of ( )
		text token ( )
		trailer token ( ) ( )
		types ( ) ( )
		xatom token ( )
		xclient token ( )
		xcolormap token ( )
		xcursor token ( )
		xfont token ( )
		xgc token ( )
		xpixmap token ( )
		xproperty token ( )
		xselect token ( )
		xwindow token ( )

	audit trail
		analysis
			auditing features ( ) ( )
			auditreduce command ( ) ( )
			costs ( )
			finding failed login attempts ( )
			of cost ( )
			praudit command ( ) ( )
		analyzing ( )
		auditreduce command ( ) ( )
		creating
			audit daemon's role ( ) ( ) ( )
			audit_data file ( )
			directory suitability ( )
			managing audit file size ( )
			overview ( )
		debugging ( )
		directory locations ( ) ( ) ( )
		events included ( )
		merging ( )
		monitoring in real time ( )
		overflow prevention ( ) ( )
		praudit command ( ) ( )

	audit_user file
		prefixes for flags ( )
		process preselection mask ( )
		user audit fields ( ) ( )

	audit_warn script ( ) ( )
		allhard string ( ) ( )
		allsoft string ( )
		auditsvc string ( )
		conditions invoking ( ) ( )
		described ( ) ( ) ( )
		ebusy string ( )
		hard string ( )
		postsigterm signal ( )
		soft string ( )
		tmpfile string ( )

	auditconfig command
		audit flags as arguments ( )
		changing class mappings ( )
		options ( ) ( )
		prefixes for flags ( )

	auditd daemon
		audit_startup file ( )
		audit trail creation ( ) ( ) ( )
		audit_warn script
			conditions invoking ( ) ( )
			described ( ) ( ) ( )
			execution of ( ) ( )
		directories suitable to ( )
		enabling auditing ( )
		functions ( )
		order audit files are opened ( )
		rereading the audit_control file ( )

	auditing
		advanced setup procedures ( ) ( )
		advanced tasks for security administrator ( )
		audit ID ( )
		audit session ID ( )
		for efficiency ( )
		basic setup procedures ( ) ( )
		basic tasks for security administrator ( )
		client-server relationships ( ) ( )
		considerations ( )
		defaults ( ) ( )
			audit_startup file ( )
		disabling ( ) ( )
		dynamic procedures ( )
		enabling ( ) ( ) ( )
		overview of administration ( ) ( )
		planning ( ) ( )
		removing free space ( )
		setup tasks for system administrator ( )
		shutdown ( )
		site planning ( )
		software packages ( )
		space planning ( ) ( )
		startup ( ) ( )
		user ID ( )
		warning of trouble ( )

	auditon audit record
		A_GETCAR command ( )
		A_GETCLASS command ( )
		A_GETCOND command ( )
		A_GETCWD command ( )
		A_GETKMASK command ( )
		A_GETSTAT command ( )
		A_GPOLICY command ( )
		A_GQCTRL command ( )
		A_SETCLASS command ( )
		A_SETCOND command ( )
		A_SETKMASK command ( )
		A_SETSMASK command ( )
		A_SETSTAT command ( )
		A_SETUMASK command ( )
		A_SPOLICY command ( )
		A_SQCTRL command ( )

	auditpsa audit record ( )

	auditreduce command
		capabilities ( )
		cleaning not_terminated files ( )
		described ( )
		distributed systems ( )
		examples ( ) ( ) ( )
		time stamp use ( )

	auditstat audit record ( )

	auditsvc, system call fails ( )

	auditsvc audit record ( )

	auditwrite audit record ( )

	AUE_... names ( )

	authorization use audit record ( )

	ax audit class ( )

	ax audit flag ( )


B

	backup, audit files ( )

	binary audit record format ( )


C

	caret (^) in audit flag prefixes ( )

	change password audit record ( )

	change workspace SL audit record ( )

	chdir audit record ( )

	chmod audit record ( )

	chown audit record ( )

	chroot audit record ( ) ( )

	chstate audit record ( )

	cl audit class ( )

	cl audit flag ( )

	classes
		changing definitions ( )
		flags and definitions ( )
		mapping events ( )
		overview ( ) ( )
		selecting for auditing ( )

	clearance token ( )

	clock_settime audit record ( )

	close audit record ( )

	cnt policy, flag ( )

	commands, executing with privilege ( )

	configuration files, distributing to workstations ( )

	core dump audit record ( )

	cost control ( ) ( )
		analysis ( )
		processing time ( )
		storage ( ) ( )

	creat audit record ( )

	creating the audit trail
		audit daemon's role ( ) ( )
		audit_data file ( )
		directory suitability ( )
		overview ( )

	cron job ( )

	crontab audit record
		cron-invoke atjob ( )
		crontab ( )
		crontab-crontab created ( )
		crontab-crontab deleted ( )
		crontab-permission ( )


D

	daemons, audit
		See audit daemon

	date-time auditreduce command, options ( )

	dbmgr audit records ( )

	defaults
		audit policies ( )
		machine-wide ( )

	Device Allocation Manager, using ( )

	devices, allocating and deallocating ( )

	dir: line in audit_control file
		described ( )
		example ( )
		for files ( )
		for files subdirectory ( )

	directories
		audit_control file definitions ( )
		audit daemon pointer ( ) ( )
		audit directories full ( ) ( ) ( )
		audit directory locations ( ) ( ) ( )
		diskfull machines ( )
		files subdirectory ( )
		files subdirectory for audit records ( )
		mounting audit directories ( )
		suitable to audit daemon ( )

	disk space requirements ( ) ( )

	diskfull machines' audit directory ( )

	dispadmin audit record ( )

	distributed systems' auditreduce command use ( )

	drvpolicy audit record ( )

	dtfile audit records ( )


E

	ebusy string and audit_warn script ( )

	eeprom audit record ( )

	ending
		signal received during auditing shutdown ( )
		terminating audit daemon ( ) ( )

	enter prom audit record ( )

	errors
		audit directories full ( ) ( ) ( )
		internal errors ( )

	/etc/init.d/audit script
		disabling auditing ( )
		enabling auditing ( ) ( )

	/etc/security/audit_data file ( )

	/etc/security/audit directory ( ) ( )

	/etc/security/audit_event file
		overview ( ) ( )
		audit event type ( )

	/etc/security/audit_startup file ( )

	/etc/security/audit_warn script ( ) ( ) ( )

	/etc/security directory ( ) ( )

	event-class mappings
		changing ( )
		planning ( )

	event numbers ( )

	events
		categories ( )
		including in audit trail ( )
		kernel events
			audit tokens ( )
			auditconfig command options ( )
			described ( )
		mapping to classes ( )
		non-attributable ( )
		numbers ( )
		overview ( ) ( )
		record formats and ( )
		user-level events
			audit tokens ( )
			auditconfig command options ( )
			described ( )

	exec_args token ( ) ( )

	exec audit record ( )

	exec_env token ( ) ( )

	execve audit record ( )

	exit audit record ( )

	exit prom audit record ( )

	exit token ( ) ( )


F

	fa audit class ( )

	fa audit flag ( )

	failure
		audit flag prefix ( )
		turning off audit flags for ( )

	fauditpsa audit record ( )

	fc audit class ( )

	fc audit flag ( )

	fchdir audit record ( )

	fchmod audit record ( )

	fchown audit record ( )

	fchroot audit record ( )

	fcntl audit record ( )

	fd audit class ( )

	fd audit flag ( )

	fgetcmwlabel audit record ( )

	fgetsldname audit record ( )

	file systems
		See also audit files
		free space on audit servers ( )

	file token ( )

	files, setting public object bit ( )

	files, audit
		See audit files

	files and file systems
		handling audit trail overflow ( )
		protecting ( )

	files subdirectory ( ) ( )

	flags
		audit_control file line ( )
		audit_user file ( ) ( )
		definitions ( )
		machine-wide ( ) ( )
		overview ( )
		policy flags ( )
		process preselection mask ( )
		syntax ( ) ( )

	flags: line in audit_control file
		described ( )
		prefixes in ( )
		process preselection mask ( )

	fm audit class ( ) ( ) ( ) ( ) ( ) ( ) ( ) ( ) ( ) ( )

	fm audit flag ( )

	fn audit class ( )

	fn audit flag ( )

	fork1 audit record ( )

	fork audit record ( )

	fr audit class ( )

	fr audit flag ( )

	freeze audit record ( )

	fsetcmwlabel audit record ( )

	fsetfattrflag audit record ( )

	fstatfs audit record ( )

	ftpd login audit record ( )

	fuser audit record ( )

	fw audit class ( )

	fw audit flag ( )


G

	getaudit audit record ( )

	getauid audit record ( )

	getcmwfsrange audit record ( )

	getcmwlabel audit record ( )

	getdents audit record ( )

	getfilepriv audit record ( )

	getmldadorn audit record ( )

	getmsg audit record ( )
		socket accept ( )
		socket receive ( )

	getmsgqcmwlabel audit record ( )

	getpmsg audit record ( )

	getportaudit audit record ( )

	getsemcmwlabel audit record ( )

	getshmcmwlabel audit record ( )

	getsldname audit record ( )

	group token ( )

	groupmgr audit record ( )

	groups token ( )


H

	halt audit record ( )

	hard disk space requirements ( ) ( )

	hard string with audit_warn script ( )

	header token
		described ( ) ( ) ( )
		fields ( ) ( )
		format ( )
		order in audit record ( )
		praudit display ( ) ( )

	host token ( ) ( )

	hostmgr audit records ( )

	human-readable audit record format
		converting audit records to ( ) ( )
		described ( )


I

	icons, for device allocation ( )

	IDs
		audit ( ) ( ) ( )
		audit session ( ) ( )
		audit user ( )
		terminal ( )

	in_addr token ( ) ( )

	in.ftpd audit record ( )

	in.rexecd audit record ( )

	in.rshd audit record ( )

	inetd: service request audit record ( )

	init audit record, run level change information ( )

	installf audit record ( )

	Internet-related tokens, socket token ( )

	io audit class ( ) ( )

	io audit flag ( )

	ioctl: ioctl to special devices audit record ( )

	ip audit class ( )

	ip audit flag ( )

	ip token ( )

	ipc_perm token ( ) ( )

	ipc token ( ) ( ) ( ) ( )

	ipc type field values (ipc token) ( )

	iport token ( )

	item size field values (arbitrary token) ( )


K

	kernel events
		audit number range ( )
		audit records ( ) ( )
		audit tokens ( )
		auditconfig command options ( )
		described ( )

	kill audit record ( )


L

	lchown audit record ( )

	lgetcmwlabel audit record ( )

	liaison token ( )

	link audit record ( )

	lo audit flag ( )

	log files
		See also audit files

	login audit record
		logout ( )
		praudit display ( )
		rlogin ( ) ( )
		telnet login ( )
		terminal login ( )

	login/logout messages, copying to single file ( ) ( )

	lpsched audit records ( ) ( )

	lsetcmwlabel audit record ( )

	lstat audit record ( )

	lxstat audit record ( )


M

	machine halt audit record ( )

	machine reboot audit record ( )

	mail, creating audit_warn alias ( )

	mask, process preselection
		described ( )
		reducing storage costs ( ) ( )

	memcntl audit record ( )

	minfree: line in audit_control file ( )
		audit_warn ( )
		described ( )

	minus (-) audit flag prefix ( ) ( ) ( )

	mkdir audit record ( )

	mknod audit record ( )

	mldsetfattrflag audit record ( )

	mmap audit record ( )

	modctl audit record
		MODADDMAJBIND command ( )
		MODCONFIG command ( )
		MODLOAD command ( )
		MODUNLOAD command ( )

	modify system files audit record ( )

	modload audit record ( )

	modunload audit record ( )

	monitoring audit trail in real time ( )

	mount audit record ( )

	mountd audit record ( )

	msgctl audit record
		IPC_RMID command ( )
		IPC_SET command ( )
		IPC_STAT command ( )

	msgget audit record ( )

	msggetl audit record ( )

	msgrcv audit record ( )

	msgsnd audit record ( )

	munmap audit record ( )


N

	na audit class ( )

	na audit flag ( )

	naflags: line in audit_control file ( )

	names
		audit classes ( )
		audit files
			closed files ( )
			form ( ) ( )
			still-active files ( ) ( )
			time stamps ( )
			use ( )
		audit flags ( )
		audited kernel events ( )
		IDs
			audit ( ) ( )
			audit session ( ) ( )
			terminal ( )
		mount-point path names on audit servers ( )

	networked workstations, planning space ( )

	never-audit flags ( ) ( )

	newgroups token ( )

	NFS request audit record, automount ( )

	NFS request audit record
		mount ( ) ( )
		mountd ( )
		unmount ( )

	nice audit record ( )

	no audit class ( )

	no audit flag ( )

	non-networked workstations, planning space ( )

	nonattributable flags in audit_control file ( )

	nt audit class ( )

	nt audit flag ( )

	numbers, audit events ( )


O

	opaque token ( )

	open audit record
		read ( )
		read, create ( )
		read, create, truncate ( )
		read, truncate ( )
		read, write ( )
		read, write, create ( )
		read, write, create, truncate ( )
		read, write, truncate ( )
		write ( )
		write, create ( )
		write, create, truncate ( )
		write, truncate ( )

	/opt/SUNWadm/2.3/bin/dbmgr audit record ( )

	/opt/SUNWadm/2.3/bin/groupmgr audit record ( )

	/opt/SUNWadm/2.3/bin/hostmgr audit records ( )

	/opt/SUNWadm/2.3/bin/printmgr audit records ( )

	/opt/SUNWadm/2.3/bin/profmgr audit records ( ) ( ) ( )

	/opt/SUNWadm/2.3/bin/serialmgr audit records ( )

	/opt/SUNWadm/2.3/bin/usermgr audit records ( )

	ot audit class ( )

	ot audit flag ( )


P

	passwd audit record ( )

	path policy flag ( )

	path token ( )

	pathconf audit record ( )

	pbind audit record ( )

	pc audit flag ( )

	pfsh audit record ( )

	pipe audit record ( )

	pkgadd audit record ( )

	pkgrm audit record ( )

	pm audit flag ( )

	postsigterm string and audit_warn script ( )

	praudit command
		changing field separator ( )
		changing token separator ( )
		human-readable format ( )
		output formats ( ) ( )
		piping auditreduce output to ( ) ( )
		using ( ) ( )

	preadl audit record ( )

	preselection mask
		described ( )
		reducing storage costs ( ) ( )

	primary audit directory ( )

	print format field values (arbitrary token) ( )

	printing with authorization audit record ( )

	printmgr audit record ( )

	priocntl audit record ( )

	priv token ( )

	privenable audit record ( )

	privilege
		audit records for use of ( )
		when executing commands ( )

	privilege token ( ) ( )

	privilege use audit record ( )

	process audit characteristics ( ) ( )
		audit ID ( )
		audit session ID ( )
		process preselection mask ( ) ( ) ( )
		terminal ID ( )

	process dumped core audit record ( )

	process preselection mask
		described ( )
		reducing storage costs ( ) ( )

	process token ( )

	processing time costs ( )

	profile shell
		audit record ( )
		opening ( )

	profmgr audit records ( ) ( ) ( )

	ps audit class ( )

	ps audit flag ( )

	pseudo-events, audit records ( )

	psradm audit record ( )

	putmsg audit record ( )
		socket connect ( )

	putpmsg audit record ( )

	pwritel audit record ( )


R

	read audit record ( )

	readl audit record ( )

	readlink audit record ( )

	readvl audit record ( )

	reboot audit record ( )

	records
		See audit records

	rem_drv audit record ( )

	removef audit record ( )

	rename audit record ( )

	restoration, audit files ( )

	return token ( )

	rmdir audit record ( )

	rpc.rexd audit record ( )

	rsh access audit record ( )


S

	secondary audit directory ( )

	security, auditing tasks for administrators ( )

	selection manager audit record ( )

	semctl audit record
		GETALL command ( )
		GETNCNT command ( )
		GETPID command ( )
		GETVAL command ( )
		GETZCNT command ( )
		IPC_RMID command ( )
		IPC_SET command ( )
		IPC_STAT command ( )
		SETALL command ( )
		SETVAL command ( )

	semget audit record ( )

	semgetl audit record ( )

	semop audit record ( )

	sendmail audit record ( ) ( )

	seq policy flag ( )

	seq token ( )

	serialmgr audit records ( )

	session ID ( ) ( )

	setacl audit record ( )

	setaudit audit record ( )

	setauid audit record ( )

	setclearance audit record ( )

	setcmwlabel audit record ( )

	setcmwplabel audit record ( )

	setegid audit record ( )

	seteuid audit record ( )

	setfacl audit record ( )

	setfattrflag audit record ( )

	setfpriv audit record ( )

	setgid audit record ( )

	setgroups audit record ( )

	setpattr audit record ( )

	setpgrp audit record ( )

	setppriv audit record ( )

	setregid audit record ( )

	setreuid audit record ( )

	setrlimit audit record ( )

	setuid audit record ( )

	setuname audit record ( )

	share audit record ( )

	shmat audit record ( )

	shmctl audit record
		IPC_RMID command ( )
		IPC_SET command ( )
		IPC_STAT command ( )

	shmdt audit record ( )

	shmget audit record ( )

	shmgetl audit record ( )

	signal received during auditing shutdown ( )

	size
		managing audit files ( )
		reducing audit files
			storage space requirements ( ) ( )

	slabel token ( )

	socket accept audit record ( )

	socket connect audit record ( )

	socket-inet token ( )

	socket send audit record ( )

	socket token ( )

	soft limit
		audit_warn condition ( )
		minfree: line described ( )

	soft string with audit_warn script ( )

	ss audit class ( )

	ss audit flag ( )

	stat audit record ( )

	statfs audit record ( )

	statvfs audit record ( )

	stime audit record ( )

	storage costs ( ) ( )

	su audit record ( )

	subject token ( )

	success
		audit flag prefix ( )
		turning off audit flags for ( )

	SUNWcar package ( )

	SUNWcsr package ( )

	SUNWcsu package ( )

	SUNWhea package ( )

	SUNWman package ( )

	SUNWtsr package ( )

	SUNWtsu package ( )

	swap audit record ( )

	symlink audit record ( )

	sysinfo audit record ( )

	system booted audit record ( )

	system calls
		audit event numbers ( )
		auditsvc fails ( )
		return token ( ) ( )

	system rebooted audit record ( )

	system remounted audit record ( )

	system shutdown audit record ( )

	System V IPC
		ipc token ( ) ( )


T

	temporary file cannot be used ( )

	terminal ID ( )

	terminating, signal received during auditing shutdown ( )

	text token ( )

	time-date auditreduce command options ( )

	time stamps in audit files ( )

	tmpfile string and audit_warn script ( )

	tnif audit record ( )

	tnrh audit record ( )

	tnrhtp audit record ( )

	tokens
		See audit tokens

	tokmapper audit record ( )

	trail
		See audit trail

	trailer token
		format ( )
		order in audit record ( )
		praudit display ( )

	troubleshoot ( ) ( )

	trusted editor audit record ( )


U

	uadmin audit record
		system freeze ( )
		system reboot ( )
		system remount ( )
		system shutdown ( )
		user-level command ( )

	uauth audit record ( ) ( )

	uauth printing audit records ( )

	UIDs
		user ID (audit ID) ( ) ( ) ( )

	umount: old version audit record ( )

	uname audit record ( )

	unlink audit record ( )

	unshare audit record ( )

	user audit fields ( ) ( )

	user ID (audit ID) ( )

	user-level events
		audit records ( ) ( )
		audit tokens ( )
		auditconfig command options ( )
		described ( )

	usermgr audit records ( )

	users, auditing normal users ( )

	/usr/bin/at audit record
		at-create crontab ( )
		at-delete atjob ( )
		at-permission ( )

	/usr/bin/crontab audit record
		crontab-crontab created ( )
		crontab-crontab deleted ( )
		cron-invoke atjob ( )
		crontab-permission ( )
		crontab ( )

	/usr/bin/login audit record
		logout ( )
		rlogin ( ) ( )
		telnet login ( )
		terminal login ( )

	/usr/bin/passwd: change password audit record ( )

	/usr/bin/pfsh audit record ( )

	/usr/bin/setuname audit record ( )

	/usr/bin/su audit record ( )

	/usr/bin/uname audit record ( )

	/usr/dt/bin/dtfile audit record ( )

	/usr/lib/lpadmin audit record ( )

	/usr/lib/lpsched audit records ( ) ( )

	/usr/lib/nfs/mountd audit record
		NFS mount request ( )
		automount mismatch ( )
		NFS unmount request ( )
		automount request ( )

	/usr/lib/sendmail audit record ( ) ( )

	/usr/sbin/add_drv audit record ( )

	/usr/sbin/allocate audit record
		allocate-list device failure ( )
		allocate-list device success ( )
		device allocate failure ( )
		device allocate success ( ) ( )

	/usr/sbin/audit audit record ( )

	/usr/sbin/chroot audit record ( )

	/usr/sbin/deallocate audit record
		deallocate device failure ( )
		deallocate device ( )

	/usr/sbin/eeprom audit record ( )

	/usr/sbin/fuser audit record ( )

	/usr/sbin/halt audit record ( )

	/usr/sbin/in.ftpd audit record ( )

	/usr/sbin/in.rexecd audit record ( )

	/usr/sbin/in.rshd audit record ( )

	/usr/sbin/inetd audit record ( )

	/usr/sbin/init audit record ( )

	/usr/sbin/installf audit record ( )

	/usr/sbin/modload audit record ( )

	/usr/sbin/modunload audit record ( )

	/usr/sbin/pbind audit record ( )

	/usr/sbin/psradm audit record ( )

	/usr/sbin/reboot audit record ( )

	/usr/sbin/removef audit record ( )

	/usr/sbin/rpc.rexd audit record ( )

	/usr/sbin/swap audit record ( )

	/usr/sbin/uadmin audit record ( )

	utime audit record ( )

	utimes audit record ( )

	utssys - fusers audit record ( )


V

	vfork audit record ( )

	vtrace audit record ( )


W

	workspaces
		Change SL audit record ( )
		changing to admin_high ( )

	workstations, planning audit space ( )

	write audit record ( )

	writel audit record ( )

	writevl audit record ( )


X

	X server extensions audit record ( )

	xa audit class ( )

	xa audit flag ( )

	XAllocColor audit record ( )

	XAllocColorCells audit record ( )

	XAllocColorPlanes audit record ( )

	XAllocNamedColor audit record ( )

	xatom token ( )

	XBell audit record ( )

	xc audit class ( )

	xc audit flag ( )

	XChangeActivePointerGrab audit record ( )

	XChangeGC audit record ( )

	XChangeHosts audit record ( )

	XChangeKeyboardControl audit record ( )

	XChangeKeyboardMapping audit record ( )

	XChangePointerControl audit record ( )

	XChangeProperty audit record ( )

	XChangeSaveSet audit record ( )

	XChangeWindowAttributes audit record ( )

	XCirculateWindow audit record ( )

	XClearArea audit record ( )

	xclient token ( )

	XClientConnect audit record ( )

	XClientDisconnect audit record ( )

	xcolormap token ( ) ( )

	XConfigureWindow audit record ( )

	XConvertSelection audit record ( )

	XCopyArea audit record ( )

	XCopyColormapAndFree audit record ( )

	XCopyGC audit record ( )

	XCopyPlane audit record ( )

	XCreateColormap audit record ( )

	XCreateCursor audit record ( )

	XCreateGlyphCursor audit record ( )

	XCreateWindow audit record ( )

	xcursor token ( )

	XDeleteProperty audit record ( )

	XDestroySubwindows audit record ( )

	XDestroyWindow audit record ( )

	XFillPolygon audit record ( )

	xfont token ( )

	XForceScreenSaver audit record ( )

	XFreeColormap audit record ( )

	XFreeColors audit record ( )

	XFreeCursor audit record ( )

	XFreeGC audit record ( )

	XFreePixmap audit record ( )

	xgc token ( )

	XGetAtomName audit record ( )

	XGetGeometry audit record ( )

	XGetImage audit record ( )

	XGetInputFocus audit record ( )

	XGetMotionEvents audit record ( )

	XGetProperty audit record ( )

	XGetSelectionOwner audit record ( )

	XGetWindowAttributes audit record ( )

	XGrabButton audit record ( )

	XGrabKey audit record ( )

	XGrabKeyboard audit record ( )

	XGrabPointer audit record ( )

	XGrabServer audit record ( )

	XImageText16 audit record ( )

	XImageText8 audit record ( )

	XInstallColormap audit record ( )

	XInternAtom audit record ( )

	XKillClient audit record ( )

	xl audit class ( )

	xl audit flag ( )

	XListInstalledColormap audit record ( )

	XListProperty audit record ( )

	XLookupColor audit record ( )

	XMapSubwindows audit record ( )

	XMapWindow audit record ( )

	xmknod audit record ( )

	xp audit class ( )

	xp audit flag ( )

	xpixmap token ( )

	XPolyArc audit record ( )

	XPolyFillArc audit record ( )

	XPolyFillRectangle audit record ( )

	XPolyLine audit record ( )

	XPolyPoint audit record ( )

	XPolyRectangle audit record ( )

	XPolySegment audit record ( )

	XPolyText16 audit record ( )

	XPolyText8 audit record ( )

	xproperty token ( )

	XPutImage audit record ( )

	XQueryColors audit record ( )

	XQueryKeymap audit record ( )

	XQueryPointer audit record ( )

	XQueryTree audit record ( )

	XRecolorCursor audit record ( )

	XReparentWindow audit record ( )

	XRotateProperties audit record ( )

	xs audit class ( )

	xs audit flag ( )

	xselect token ( )

	XSendEvent audit record ( )

	Xserver protocols
		audit records ( ) ( )

	XSetAccessControl audit record ( )

	XSetClipRectangles audit record ( )

	XSetCloseDownMode audit record ( )

	XSetDashes audit record ( )

	XSetFontPath audit record ( )

	XSetInputFocus audit record ( )

	XSetModifierMapping audit record ( )

	XSetPointerMapping audit record ( )

	XSetScreenSaver audit record ( )

	XSetSselectionOwner audit record ( )

	xstat audit record ( )

	XStoreColors audit record ( )

	XStoreNamedColor audit record ( )

	XTranslateCoords audit record ( )

	XUngrabButton audit record ( )

	XUngrabKey audit record ( )

	XUngrabKeyboard audit record ( )

	XUnGrabPointer audit record ( )

	XUngrabServer audit record ( )

	XUninstallColormap audit record ( )

	XUnmapSubwindows audit record ( )

	XUnmapWindow audit record ( )

	XWarpPointer audit record ( )

	xwindow token ( )

	xx audit flag ( )

Previous: Appendix C Audit Reference