Audit Classes

Each audit event is also defined as belonging to an audit class or classes. By assigning events to classes, you can more easily deal with large numbers of events. When you name a class, you simultaneously address all the events in that class. The mapping of audit events to classes is configurable. These configuration changes can be made in the audit_event file.

Whether an auditable event is recorded in the audit trail depends on whether you preselect a class for auditing that includes the specific event. The are 32 possible audit classes. The classes include the two global classes: all and no. The audit classes are described in Table 25–2.