Go to main content

Managing Auditing in Oracle® Solaris 11.4

Exit Print View

Updated: February 2019

New Feature – Listing Audit Events by Audit Class

The auditconfig -lsevent command takes an audit_flags argument that displays the audit events in the specified classes.

The following example specifies the as and lo audit flags:

$ auditconfig -lsevent as,lo
AUE_UMOUNT                        12 as umount(2) - old version
AUE_ACCT                          18 as acct(2)
AUE_ADJTIME                       50 as adjtime(2)
AUE_MOUNT                         62 as mount(2)


AUE_login                       6152 lo login - local
AUE_logout                      6153 lo logout
AUE_telnet                      6154 lo login - telnet
AUE_rlogin                      6155 lo login - rlogin
AUE_rshd                        6158 lo rsh access
AUE_su                          6159 lo su 

See the auditconfig(8) and audit_flags(7) man pages.