F AIX Audit Events
AIX audit events include AIX-related commands, such as PROC_Create.
The following table lists the AIX Audit Events.
Table F-1 AIX Audit Events
Source Event | Event Description | Command Class | Target Type |
---|---|---|---|
PROC_Create |
Creates a new process. |
CREATE |
PROCEDURE |
PROC_Delete |
Terminates the calling process. |
DELETE |
PROCEDURE |
PROC_Execute |
Executes a new program. |
EXECUTE |
PROCEDURE |
FILE_Accessx |
Determines the accessibility of a file |
RETRIEVE |
FILE |
FILE_StatAcl |
Retrieves the access control information for a file. |
RETRIEVE |
FILE |
FILE_Frevoke |
Revokes access to a file by other processes. |
REVOKE |
FILE |
PROC_Environ |
Change various piece of user information data. |
ALTER |
USER_INFORMATION |
PROC_SetSignal |
Action to take upon delivery of signal. |
SET |
PROCEDURE |
PROC_Limits |
Controls max system resource consumption |
SET |
SYSTEM_RESOURCE |
PROC_Setpri |
Sets fixed priority for process. |
EXECUTE |
FUNCTION |
PROC_Privilege |
Changes one or more privilege vectors for process. |
ALTER |
PROCESS |
PROC_Settimer |
Sets current value for a specified system wide timer. |
SET |
TIMER |
PROC_Adjtime |
Changes system clock. |
ALTER |
SYSTEM_CLOCK |
PROC_Debug |
Traces the execution of another process. |
TRACE |
PROCESS |
PROC_Kill |
Sends a signal to a process or group of processes. |
STOP |
PROCESS |
PROC_setpgid |
Sets the process id group. |
SET |
PROCESS_ID |
PROC_Load |
Loads new object module into process address space. |
ASSIGN |
PROCESS |
PROC_SetGroups |
Change process concurrent group set. |
ALTER |
PROCESS |
PROC_Sysconfig |
Calls to the sysconfig subroutine. |
EXECUTE |
SYSCONFIG |
AUD_Bin_Def |
Modification of auditbin. |
ALTER |
AUDIT_BIN |
AUD_Events |
Modification of Events. |
ALTER |
AUDIT_EVENTS |
AUD_Objects |
Modification of auditobj. |
ALTER |
AUDIT_OBJETCS |
ACCT_Disable |
Disables system accounting. |
DISABLE |
SYSTEM_ACCOUNTING |
ACCT_Enable |
Enables system accounting. |
ENABLE |
SYSTEM_ACCOUNTING |
FILE_Open |
calls to the open subroutine. |
OPEN |
FILE |
FILE_Read |
Reads from file descriptor. |
READ |
FILE |
FILE_Write |
Writes data to descriptor. |
WRITE |
FILE |
FILE_Close |
Closes open file descriptor. |
CLOSE |
FILE |
FILE_Link |
Creates new directory entry for file. |
CREATE |
LINK |
FILE_Unlink |
Removes a file system object. |
DELETE |
FILE |
FILE_Rename |
Changes name of a file system object. |
RENAME |
FILE |
FILE_Owner |
Changes file ownership. |
ALTER |
OWNER |
FILE_Mode |
Changes file mode. |
ALTER |
FILE |
FILE_Fchmod |
Changes file permission for file descriptor |
ALTER |
FILE |
FILE_Fchown |
Changes ownership for file descriptor. |
ALTER |
FILE |
FILE_Truncate |
Calls to the truncate subroutine. |
TRUNCATE |
FILE |
FILE_Symlink |
Creates symbolic link. |
CREATE |
SYMBOLIC_LINK |
FILE_Pipe |
Creates unnamed pipe. |
CREATE |
PIPE |
FILE_Mknod |
Calls to the mknod subroutine. |
CREATE |
NODE |
FILE_Dupfd |
Duplicates file descriptor. |
COPY |
FILE |
FS_Extend |
Extends file system. |
EXTEND |
FILE |
FS_Mount |
Connects file system to named directory. |
CONNECT |
FILE |
FS_Umount |
Disconnects mounted file system. |
DISCONNECT |
FILE |
FILE_Acl |
Changes file access control list (ACL) |
ALTER |
FILE |
FILE_Facl |
Changes ACL for file descriptor. |
ALTER |
FILE_DESCRIPTOR |
FILE_Privilege |
Calls to the chpriv subroutine. |
ALTER |
PRIVILEGE |
FILE_Chpriv |
Changes privilege control list. |
ALTER |
PRIVILEGE_CONTROL_LIST |
FILE_Fchpriv |
Changes PCL for file descriptor. |
ALTER |
FILE_DESCRIPTOR |
FS_Chdir |
Changes current working directory. |
ALTER |
DIRECTORY |
FS_Fchdir |
Changes current working directory by file descriptor. |
ALTER |
DIRECTORY |
FS_Chroot |
Changes meaning of “/” for current process. |
ALTER |
PROCESS |
FS_Rmdir |
Removes directory object. |
DELETE |
DIRECTORY |
FS_Mkdir |
Creates directory. |
CREATE |
DIRECTORY |
FILE_Utimes |
Calls to the utimes subroutine. |
EXECUTE |
PROCESS |
FILE_Stat |
Calls to the stat subroutine. |
EXECUTE |
PROCESS |
MSG_Create |
Creates new message queue. |
CREATE |
QUEUE |
MSG_Read |
Receives message from message queue. |
RECEIVE |
MESSAGE |
MSG_Write |
Sends message on message queue. |
SEND |
MESSAGE |
MSG_Delete |
Removes message queue. |
DELETE |
MESSAGE |
MSG_Owner |
Changes ownership and access right of message queue. |
ALTER |
MESSAGE_QUEUE |
MSG_Mode |
Queries semaphore set access rights. |
SET |
ACCESS_RIGHTS |
SHM_Create |
Creates new shared memory segment. |
CREATE |
MEMORY_SEGMENT |
SHM_Open |
Calls to the shmat subroutine with Open option. |
OPEN |
MEMORY_SEGMENT |
SHM_Detach |
Calls to the shmat subroutine with Detach option. |
DISASSOCIATE |
MEMORY_SEGMENT |
SHM_Close |
Closes shared memory segment. |
CLOSE |
MEMORY_SEGMENT |
SHM_Owner |
Changes ownership and access rights for shared memory segment. |
ALTER |
MEMORY_SEGMENT |
SHM_Mode |
Queries access rights of shared memory segment. |
ACCESS |
MEMORY_SEGMENT |
TCPIP_config |
Logs changes to TCP/IP interface. |
WRITE |
TCP/IP |
TCPIP_host_id |
Logs attempts to change system host name. |
WRITE |
TCP/IP |
TCPIP_route |
Logs changes to routing table. |
WRITE |
TCP/IP |
TCPIP_connect |
Calls to the connect subroutine. |
CONNECT |
TCP/IP |
TCPIP_data_out |
Data sent. |
SEND |
TCP/IP |
TCPIP_data_in |
Data received. |
RECEIVE |
TCP/IP |
TCPIP_set_time |
Logs attempt to change system time via network. |
SET |
TCP/IP |
TCP_ksocket |
Calls to the kernel TCPIP kernel services. |
EXECUTE |
TCP/IP |
TCP_ksocketpair |
Calls to the kernel TCPIP kernel services. |
EXECUTE |
TCP/IP |
TCP_kclose |
Calls to the kernel TCPIP kernel services. |
CLOSE |
TCP/IP |
TCP_ksetopt |
Calls to the kernel TCPIP kernel services. |
SET |
TCP/IP |
TCP_kbind |
Calls to the kernel TCPIP kernel services. |
CONNECT |
TCP/IP |
TCP_klisten |
Calls to the kernel TCPIP kernel services. |
COMMUNICATE |
TCP/IP |
TCP_kconnect |
Calls to the kernel TCPIP kernel services. |
CONNECT |
TCP/IP |
TCP_kaccept |
Calls to the kernel TCPIP kernel services. |
CONNECT |
TCP/IP |
TCP_kshutdown |
Calls to the kernel TCPIP kernel services. |
SHUTDOWN |
TCP/IP |
TCP_ksend |
Calls to the kernel TCPIP kernel services. |
SEND |
TCP/IP |
TCP_kreceive |
Calls to the kernel TCPIP kernel services. |
RECEIVE |
TCP/IP |
USER_Login |
Calls to the Terminal State Management service. |
LOGIN |
ACCOUNT |
SYSCK_Check |
Calls to the sysck function. |
EXECUTE |
PROCEDURE |
SYSCK_Update |
Calls to the sysck function. |
UPDATE |
PROCEDURE |
SYSCK_Install |
Calls to the sysck function. |
INSTALL |
PROCEDURE |
SYSCK_Delete |
Calls to the sysck function. |
DELETE |
PROCEDURE |
TCBCK_Check |
Calls to the tcbck function. |
EXECUTE |
FUNCTION |
TCBCK_Update |
Calls to the tcbck function. |
UPDATE |
FUNCTION |
TCBCK_Delete |
Calls to the tcbck function. |
DELETE |
FUNCTION |
USER_Check |
Calls to the usrck function. USRCK_Error |
EXECUTE |
FUNCTION |
USER_Logout |
Calls to the logout subroutine. |
LOGOUT |
USER |
PORT_Change |
Calls to the chsec subroutine. |
ALTER |
PORT |
USER_Change |
Calls to the chuser subroutine. |
ALTER |
USER |
USER_Remove |
Removes a user. |
DELETE |
USER |
USER_Create |
Creates a user. |
CREATE |
USER |
USER_SetGroups |
Calls to the setgroups subroutine. |
SET |
GROUP |
USER_SetEnv |
Calls to the setenv subroutine. |
SET |
USER |
USER_SU |
Calls to the su subroutine. |
LOGIN |
USER |
GROUP_User |
Calls to the grpchk subroutine. |
EXECUTE |
PROCEDURE |
GROUP_Adms |
Calls to the grpchk subroutine. |
EXECUTE |
PROCEDURE |
GROUP_Change |
Calls to the chgroup subroutine. |
ALTER |
GROUP |
GROUP_Create |
Calls to the mkgroup subroutine. |
CREATE |
GROUP |
GROUP_Remove |
Calls to the rmgroup subroutine. |
DELETE |
GROUP |
PASSWORD_Change |
Changes a user password. |
UPDATE |
USER |
PASSWORD_Flags |
Calls to the pwdadm subroutine. |
ALTER |
USER |
PASSWORD_Check |
Calls to the pwdck subroutine. |
ALTER |
USER |
SRC_Start |
Starts a system resource controller. |
START |
CONTROLLER |
SRC_Stop |
Stops a system resource controller. |
STOP |
CONTROLLER |
SRC_Addssys |
Calls to the addsys subroutine. |
EXECUTE |
PROCEDURE |
SRC_Chssys |
Calls to the chssys subroutine. |
EXECUTE |
PROCEDURE |
SRC_Addserver |
Calls to the addserver subroutine. |
EXECUTE |
PROCEDURE |
SRC_Chserver |
Calls to the chserver subroutine. |
EXECUTE |
PROCEDURE |
SRC_Delssys |
Calls to the rmsys subroutine. |
EXECUTE |
PROCEDURE |
SRC_Delserver |
Calls to the rmserver subroutine. |
EXECUTE |
PROCEDURE |
ENQUE_admin |
Calls to the enq subroutine. |
EXECUTE |
PROCEDURE |
ENQUE_exec |
Calls to the qdaemon subroutine. |
EXECUTE |
PROCEDURE |
SENDMAIL_Config |
Calls to the sendmail function. |
EXECUTE |
FUNCTION |
SENDMAIL_ToFile |
Calls to the sendmail function. |
EXECUTE |
FUNCTION |
AT_JobAdd |
Calls to the at function. |
EXECUTE |
FUNCTION |
At_JobRemove |
Calls to the at function. |
EXECUTE |
FUNCTION |
CRON_JobRemove |
Calls to the cron function. |
EXECUTE |
FUNCTION |
CRON_JobAdd |
Start of a cron job. |
START |
CRON |
CRON_Start |
End of a cron job. |
START |
SYSTEM |
NVRAM_Config |
Access to the NVRAM. |
ACCESS |
NVRAM |
DEV_Configure |
Calls to the cfgmgr function. |
CONFIGURE |
FUNCTION |
DEV_Change |
Device changed. |
ALTER |
DEVICE |
DEV_Create |
Device created. |
CREATE |
DEVICE |
DEV_Start |
Device started. |
START |
DEVICE |
INSTALLP_Inst |
Calls to the installp function. |
EXECUTE |
FUNCTION |
INSTALLP_Exec |
Calls to the installp function. |
EXECUTE |
FUNCTION |
DEV_Stop |
Device stopped. |
STOP |
DEVICE |
DEV_Unconfigure |
Device unconfigured. |
DISASSOCIATE |
DEVICE |
DEV_Remove |
Device removed. |
DELETE |
DEVICE |
DSMIT_start |
Calls to the dsmit function. |
EXECUTE |
FUNCTION |
DSMIT_end |
Calls to the dsmit function. |
EXECUTE |
FUNCTION |
LVM_ChangeLV |
Calls to the lvm function. |
EXECUTE |
FUNCTION |
LVM_ChangeLV |
Calls to the lvm function. |
EXECUTE |
FUNCTION |
LVM_ChangeLV |
Calls to the lvm function. |
EXECUTE |
FUNCTION |
LVM_ChangeVG |
Calls to the lvm function. |
EXECUTE |
FUNCTION |
LVM_ChangeVG |
Calls to the lvm function. |
EXECUTE |
FUNCTION |
LVM_ChangeVG |
Calls to the lvm function. |
EXECUTE |
FUNCTION |
LVM_CreateLV |
Calls to the lvm function. |
EXECUTE |
FUNCTION |
LVM_CreateVG |
Calls to the lvm function. |
EXECUTE |
FUNCTION |
LVM_DeleteVG |
Calls to the lvm function. |
EXECUTE |
FUNCTION |
LVM_DeleteLV |
Calls to the lvm function. |
EXECUTE |
FUNCTION |
LVM_VaryoffVG |
Calls to the lvm function. |
EXECUTE |
FUNCTION |
LVM_VaryonVG |
Calls to the lvm function. |
EXECUTE |
LVM |
LVM_AddLV |
Calls to the lvm function. |
ADD |
LVM |
LVM_KDeleteLV |
Calls to the lvm function. |
DELETE |
LVM |
LVM_KDeleteVG |
Deletes a volume group from the kernel. |
DELETE |
VOLUME_GROUP |
LVM_ExtendLV |
Calls to the lvm function. |
UPDATE |
LVM |
LVM_ReduceLV |
Calls to the lvm function. |
UPDATE |
LVM |
LVM_KChangeLV |
Calls to the lvm function. |
UPDATE |
LVM |
LVM_AvoidLV |
Calls to the lvm function. |
UPDATE |
LVM |
LVM_MissingPV |
Calls to the lvm function. |
UPDATE |
PHYSICAL_VOLUME |
LVM_AddPV |
Calls to the lvm function. |
ADD |
PHYSICAL_VOLUME |
LVM_AddMissPV |
Calls to the lvm function. |
ADD |
PHYSICAL_VOLUME |
LVM_DeletePV |
Calls to the lvm function. |
DELETE |
PHYSICAL_VOLUME |
LVM_RemovePV |
Calls to the lvm function. |
DROP |
PHYSICAL_VOLUME |
LVM_AddVGSA |
Calls to the lvm function. |
ADD |
PHYSICAL_VOLUME |
LVM_DeleteVGSA |
Calls to the lvm function. |
DELETE |
PHYSICAL_VOLUME |
LVM_SetupVG |
Calls to the lvm function. |
SET |
VOLUME_GROUP |
LVM_DefineVG |
Calls to the lvm function. |
CREATE |
VOLUME_GROUP |
LVM_ChgQuorum |
Calls to the lvm function. |
UPDATE |
VOLUME_GROUP |
LVM_Chg1016 |
Calls to the lvm function. |
UPDATE |
VOLUME_GROUP |
LVM_UnlockDisk |
Calls to the lvm function. |
UNLOCK |
VOLUME_GROUP |
LVM_LockDisk |
Calls to the lvm function. |
LOCK |
VOLUME_GROUP |
BACKUP_Export |
Calls to the backup/restore function. |
BACKUP |
SYSTEM |
BACKUP_Priv |
Calls to the backup/restore function. |
BACKUP |
PRIVILEGE |
RESTORE_Import |
Calls to the backup/restore function. |
RESTORE |
SYSTEM |
USER_Shell |
Access to the shell. |
ACCESS |
SHELL |
USER_Reboot |
Calls to the reboot function. |
START |
SYSTEM |
PROC_Reboot |
Calls to the reboot function. |
START |
SYSTEM |