How to Change Which Events Are in Which Audit Classes

This procedure describes how to modify the default event to class mappings.

1. Edit the /etc/security/audit_event file to change the class mapping for each event to be changed.

2. Reboot the system or run auditconfig -conf to change the runtime kernel event-to-class mappings.