How to Change Which Events Are in Which
Audit Classes
This procedure describes how to modify the default event to class mappings.
-
Edit the /etc/security/audit_event file to
change the class mapping for each event to be changed.
-
Reboot the system or run auditconfig -conf to change the
runtime kernel event-to-class mappings.