Skip to ContentSun and Oracle Channel Sun How to Buy Log In

Trusted Solaris Audit Administration

Inom

Trusted Solaris 8 AnswerBook

Hitta mer dokumentation

Supportresurser som ingår

Ladda ner denna bok i PDF (548 KB)

Appendix A Event-to-Class Mappings

This appendix lists audit events by audit class. See the file /etc/security/audit_event for a list of events by audit event number.

Audit Events Listed by Audit Class

The Trusted Solaris environment provides the audit classes listed alphabetically by Short Name in the following table. The classes are listed in the file /etc/security/audit_class.

Table A-1 Trusted Solaris Audit Classes (Default)


Short Name	Long Name	Audit Mask	List of Events per Class
aa	Audit administration	0x00040000	Table A-2
ad	Administrative	0x000f0000	None predefined.
ao	Other administration	0x00080000	Table A-3
all	All classes	0xffffffff
ap	Application	0x00004000	Table A-4
as	System-wide administration	0x00020000	Table A-22
ax	X server	0x00002000	Table A-24
cl	File close	0x00000040	Table A-5
fa	File attribute access	0x00000004	Table A-6
fc	File create	0x00000010	Table A-7
fd	File delete	0x00000020	Table A-8
fm	File attribute modify	0x00000008	Table A-9
fn	Fcntl	0x40000000	Table A-10
fr	File read	0x00000001	Table A-11
fw	File write	0x00000002	Table A-12
il	Information label	0x00010000	Obsolete.
io	Ioctl	0x20000000	Table A-13
ip	Ipc	0x00000200	Table A-14
lo	Login or logout	0x00001000	Table A-15
na	Non-attribute	0x00000400	Table A-16
no	Invalid class	0x00000000	Table A-17
nt	Network	0x00000100	Table A-18
ot	Other	0x80000000	Table A-19
pc	Process	0x00300000	None predefined.
pm	Process modify	0x00200000	Table A-20
ps	Process start/stop	0x00100000	Table A-21
ss	Change system state	0x00010000	Table A-23
xa	X - Allowed information flows	0x40000000	Table A-25
xc	X - Object create/destroy	0x20000000	Table A-26
xl	X - Client login/logout	0x08000000	Table A-27
xp	X - Privileged operations	0x10000000	Table A-28
xs	X - Operations that fail silently	0x80000000	Table A-29
xx	X - All X events	0xf8000000	See the individual X classes.

For more information about the classes, see the audit_class(4) man page.

Events in Audit Class aa

The following table lists in alphabetical order the audit administration class of audit events provided in the Trusted Solaris 8 release.

Table A-2 Audit Administration Audit Events (Default)


Audit Event Number and Event		Where Described
`224`	`AUE_AUDITON_GETCAR`	Table B-9
`231`	`AUE_AUDITON_GETCLASS`	Table B-10
`229`	`AUE_AUDITON_GETCOND`	Table B-11
`223`	`AUE_AUDITON_GETCWD`	Table B-12
`221`	`AUE_AUDITON_GETKMASK`	Table B-13
`225`	`AUE_AUDITON_GETSTAT`	Table B-14
`141`	`AUE_AUDITON_GPOLICY`	Table B-15
`145`	`AUE_AUDITON_GQCTRL`	Table B-16
`139`	`AUE_AUDITON_GTERMID`	No longer supported.
`144`	`AUE_AUDITON_SESTATE`	No longer supported.
`232`	`AUE_AUDITON_SETCLASS`	Table B-17
`230`	`AUE_AUDITON_SETCOND`	Table B-18
`222`	`AUE_AUDITON_SETKMASK`	Table B-19
`228`	`AUE_AUDITON_SETSMASK`	Table B-20
`226`	`AUE_AUDITON_SETSTAT`	Table B-21
`227`	`AUE_AUDITON_SETUMASK`	Table B-22
`142`	`AUE_AUDITON_SPOLICY`	Table B-23
`146`	`AUE_AUDITON_SQCTRL`	Table B-24
`140`	`AUE_AUDITON_STERMID`	No longer supported.
`529`	`AUE_AUDITPSA`	Table B-25
`150`	`AUE_AUDITSTAT`	Table B-26
`136`	`AUE_AUDITSVC`	Table B-27
`530`	`AUE_FAUDITPSA`	Table B-40
`132`	`AUE_GETAUDIT`	Table B-51
`267`	`AUE_GETAUDIT_ADDR`	Table B-52
`130`	`AUE_GETAUID`	Table B-53
`147`	`AUE_GETKERNSTATE`	No longer supported.
`149`	`AUE_GETPORTAUDIT`	Table B-63
`134`	`AUE_GETUSERAUDIT`	No longer supported.
`133`	`AUE_SETAUDIT`	Table B-136
`266`	`AUE_SETAUDIT_ADDR`	Table B-137
`131`	`AUE_SETAUID`	Table B-138
`148`	`AUE_SETKERNSTATE`	No longer supported.
`135`	`AUE_SETUSERAUDIT`	No longer supported.
`9016`	`AUE_audit`	Table B-237
`9015`	`AUE_auditwrite`	Table B-238

Events in Audit Class ao

The following table lists in alphabetical order the other administration class of audit events provided in the Trusted Solaris 8 release.

Table A-3 Administrative Other Audit Events (Default)


Audit Event Number and Event		Where Described
`61`	`AUE_EXPORTFS`	Table B-292
`9`	`AUE_MKNOD`	Table B-75
`62`	`AUE_MOUNT`	Table B-82
`115`	`AUE_NFSSVC_EXIT`	No longer supported.
`58`	`AUE_NFS_GETFH`	No longer supported.
`53`	`AUE_NFS_SVC`	No longer supported.
`60`	`AUE_QUOTACTL`	No longer supported.
`268`	`AUE_UMOUNT2`	Table B-177
`12`	`AUE_UMOUNT`	Table B-176
`56`	`AUE_UNMOUNT`	No longer supported.
`233`	`AUE_UTSSYS`	Table B-180
`6200`	`AUE_allocate_succ`	Table B-230
`6201`	`AUE_allocate_fail`	Table B-231
`6144`	`AUE_at_create`	Table B-234
`6145`	`AUE_at_delete`	Table B-235
`6146`	`AUE_at_perm`	Table B-236
`9034`	`AUE_automountd_mismatch`	Table B-239
`9033`	`AUE_automountd_mount`	Table B-240
`9029`	`AUE_chroot_cmd`	Table B-241
`6147`	`AUE_cron_invoke`	Table B-244
`6148`	`AUE_crontab_create`	Table B-242
`6149`	`AUE_crontab_delete`	Table B-243
`6150`	`AUE_crontab_perm`	Table B-246
`6202`	`AUE_deallocate_succ`	Table B-248
`6203`	`AUE_deallocate_fail`	Table B-249
`9319`	`AUE_dm_add`	Table B-247
`9320`	`AUE_dm_del`
`9321`	`AUE_dm_mod`
`9031`	`AUE_fuser`	Table B-253
`9307`	`AUE_gm_add_grp`	Table B-254
`9308`	`AUE_gm_del_grp`
`9309`	`AUE_gm_mod_grp`
`9310`	`AUE_hm_add_host`	Table B-256
`9311`	`AUE_hm_del_host`
`9312`	`AUE_hm_mod_host`
`9313`	`AUE_hm_set_def`
`6205`	`AUE_listdevice_succ`	Table B-232
`6206`	`AUE_listdevice_fail`	Table B-233
`9044`	`AUE_lp_cancel`	Table B-266
`9045`	`AUE_lp_status`
`9009`	`AUE_pfsh_priv`	Table B-272
`9008`	`AUE_pfsh_trusted_nopriv`
`9007`	`AUE_pfsh_trusted_priv`
`9316`	`AUE_pm_add_prn`	Table B-275
`9318`	`AUE_pm_del_prn`
`9317`	`AUE_pm_mod_prn`
`9306`	`AUE_pm_add_prof`	Table B-276
`9304`	`AUE_pm_del_prof`
`9305`	`AUE_pm_mod_prof`
`9014`	`AUE_sendmail_defer`	Table B-288
`9013`	`AUE_sendmail_deliver`	Table B-288
`9012`	`AUE_sendmail_upgrade`	Table B-289
`9315`	`AUE_sm_del_ser`	Table B-290
`9314`	`AUE_sm_mod_ser`
`9017`	`AUE_uauth`	Table B-297 Table B-264 Table B-265
`9322`	`AUE_te_modsysfiles`	Table B-229
`9302`	`AUE_um_add_user`	Table B-298
`9301`	`AUE_um_del_user`
`9300`	`AUE_um_mod_user`
`9303`	`AUE_um_set_def`
`9024`	`AUE_uname_set`	Table B-299

Events in Audit Class ap

The following table lists in alphabetical order the application class of audit events provided in the Trusted Solaris 8 release.

Table A-4 Application Audit Events (Default)


Audit Event Number and Event		Where Described
`9010`	`AUE_pfsh_nopriv`	Table B-272
`9035`	`AUE_sl_change`	Table B-293

Events in Audit Class cl

The following table lists in alphabetical order the file close class of audit events provided in the Trusted Solaris 8 release.

Table A-5 File Close Audit Events (Default)


Audit Event Number and Event		Where Described
`112`	`AUE_CLOSE`	Table B-34
`213`	`AUE_MUNMAP`	Table B-91

Events in Audit Class fa

The following table lists in alphabetical order the file attribute access class of audit events provided in the Trusted Solaris 8 release.

Table A-6 File Attribute Access Audit Events (Default)


Audit Event Number and Event		Where Described
`14`	`AUE_ACCESS`	Table B-5
`220`	`AUE_AUDITSYS`	Placeholder
`66`	`AUE_BSMSYS`	Placeholder
`543`	`AUE_FGETCMWLABEL`	Table B-55
`55`	`AUE_FSTATFS`	Table B-50
`545`	`AUE_GETCMWFSRANGE`	Table B-54
`546`	`AUE_GETCMWLABEL`	Table B-55
`547`	`AUE_GETFILEPRIV`	Table B-57
`554`	`AUE_GETMLDADORN`	Table B-58
`555`	`AUE_GETSLDNAME`	Table B-66
`548`	`AUE_LGETCMWLABEL`	Table B-55
`17`	`AUE_LSTAT`	Table B-71
`236`	`AUE_LXSTAT`	Table B-72
`556`	`AUE_MLDLSTAT`	Obsolete.
`557`	`AUE_MLDSTAT`	Obsolete.
`64`	`AUE_MSGSYS`	Placeholder
`3`	`AUE_OPEN`	Placeholder
`199`	`AUE_OSTAT`	No longer supported.
`71`	`AUE_PATHCONF`	Table B-105
`67`	`AUE_RFSSYS`	Placeholder
`63`	`AUE_SEMSYS`	Placeholder
`65`	`AUE_SHMSYS`	Placeholder
`16`	`AUE_STAT`	Table B-165
`54`	`AUE_STATFS`
`234`	`AUE_STATVFS`
`70`	`AUE_VPIXSYS`	Placeholder
`235`	`AUE_XSTAT`	Table B-186

Events in Audit Class fc

The following table lists in alphabetical order the file create class of audit events provided in the Trusted Solaris 8 release.

Table A-7 File Create Audit Events (Default)


Audit Event Number and Event		Where Described
`8`	`AUE_CHDIR`	Table B-28
`111`	`AUE_CORE`	Table B-110
`4`	`AUE_CREAT`	Table B-35
`532`	`AUE_FGETSLDNAME`	Table B-46
`5`	`AUE_LINK`	Table B-70
`47`	`AUE_MKDIR`	Table B-74
`73`	`AUE_OPEN_RC`	Table B-94
`75`	`AUE_OPEN_RTC`	Table B-95
`81`	`AUE_OPEN_RWC`	Table B-98
`83`	`AUE_OPEN_RWTC`	Table B-99
`77`	`AUE_OPEN_WC`	Table B-102
`79`	`AUE_OPEN_WTC`	Table B-103
`42`	`AUE_RENAME`	Table B-117
`48`	`AUE_RMDIR`	Table B-118
`21`	`AUE_SYMLINK`	Table B-167
`240`	`AUE_XMKNOD`	Table B-185

Events in Audit Class fd

The following table lists in alphabetical order the file delete class of audit events provided in the Trusted Solaris 8 release.

Table A-8 File Delete Audit Events (Default)


Audit Event Number and Event		Where Described
`44`	`AUE_FTRUNCATE`	No longer supported.
`74`	`AUE_OPEN_RT`	Table B-96
`75`	`AUE_OPEN_RTC`	Table B-95
`82`	`AUE_OPEN_RWT`	Table B-100
`83`	`AUE_OPEN_RWTC`	Table B-99
`78`	`AUE_OPEN_WT`	Table B-104
`79`	`AUE_OPEN_WTC`	Table B-103
`42`	`AUE_RENAME`	Table B-117
`6`	`AUE_UNLINK`	Table B-178

Events in Audit Class fm

The following table lists in alphabetical order the file attribute modify class of audit events provided in the Trusted Solaris 8 release.

Table A-9 File Attribute Modify Audit Events (Default)


Audit Event Number and Event		Where Described
`251`	`AUE_ACLSET`	Table B-135
`11`	`AUE_CHOWN`	Table B-30
`252`	`AUE_FACLSET`	Table B-135
`39`	`AUE_FCHMOD`	Table B-42
`38`	`AUE_FCHOWN`	Table B-43
`45`	`AUE_FLOCK`	Placeholder
`544`	`AUE_FSETCMWLABEL`	Table B-140
`523`	`AUE_FSETFATTRFLAG`	Table B-49
`158`	`AUE_IOCTL`	Table B-67
`237`	`AUE_LCHOWN`	Table B-69
`525`	`AUE_LSETCMWLABEL`	Table B-140
`19`	`AUE_MCTL`	No longer supported.
`524`	`AUE_MLDSETFATTRFLAG`	Table B-76
`542`	`AUE_SETCLEARANCE`	Table B-139
`549`	`AUE_SETCMWLABEL`	Table B-140
`541`	`AUE_SETCMWPLABEL`	Table B-141
`522`	`AUE_SETFATTRFLAG`	Table B-144
`550`	`AUE_SETFILEPRIV`	Table B-145
`551`	`AUE_SETPROCPRIV`	Table B-149
`202`	`AUE_UTIME`	Table B-179
`49`	`AUE_UTIMES`
`552`	`AUE_WRITEL`	Table B-184
`553`	`AUE_WRITEVL`	Table B-184
`9037`	`AUE_dtfile_copy`	Table B-251
`9038`	`AUE_dtfile_move`	Table B-251

Events in Audit Class fn

The following table lists in alphabetical order the fcntl class of audit events provided in the Trusted Solaris 8 release.

Table A-10 Fcntl Audit Events (Default)


Audit Event Number and Event		Where Described
`30`	`AUE_FCNTL`	Table B-45

Events in Audit Class fr

The following table lists in alphabetical order the file read class of audit events provided in the Trusted Solaris 8 release.

Table A-11 File Read Audit Events (Default)


Audit Event Number and Event		Where Described
`72`	`AUE_OPEN_R`	Table B-93
`73`	`AUE_OPEN_RC`	Table B-94
`74`	`AUE_OPEN_RT`	Table B-96
`75`	`AUE_OPEN_RTC`	Table B-95
`80`	`AUE_OPEN_RW`	Table B-97
`81`	`AUE_OPEN_RWC`	Table B-98
`82`	`AUE_OPEN_RWT`	Table B-100
`83`	`AUE_OPEN_RWTC`	Table B-99
`22`	`AUE_READLINK`	Table B-115

Events in Audit Class fw

The following table lists in alphabetical order the file read class of audit events provided in the Trusted Solaris 8 release.

Table A-12 File Write Audit Events (Default)


Audit Event Number and Event		Where Described
`80`	`AUE_OPEN_RW`	Table B-97
`81`	`AUE_OPEN_RWC`	Table B-98
`82`	`AUE_OPEN_RWT`	Table B-100
`83`	`AUE_OPEN_RWTC`	Table B-99
`76`	`AUE_OPEN_W`	Table B-101
`77`	`AUE_OPEN_WC`	Table B-102
`78`	`AUE_OPEN_WT`	Table B-104
`79`	`AUE_OPEN_WTC`	Table B-103

Events in Audit Class io

The following table lists the audit event in the ioctl class provided in the Trusted Solaris 8 release.

Table A-13 Ioctl Audit Events (Default)


Audit Event Number and Event		Where Described
`158`	`AUE_IOCTL`	Table B-67

Events in Audit Class ip

The following table lists in alphabetical order the ipc class of audit events provided in the Trusted Solaris 8 release.

Table A-14 IPC Audit Events (Default)


Audit Event Number and Event		Where Described
260	`AUE_DOORFS_DOOR_BIND`	doorfs(2) - DOOR_BIND No information.
254	`AUE_DOORFS_DOOR_CALL`	doorfs(2) - DOOR_CALL
256	`AUE_DOORFS_DOOR_CREATE`	doorfs(2) - DOOR_CREATE No information.
258	`AUE_DOORFS_DOOR_INFO`	doorfs(2) - DOOR_INFO No information.
255	`AUE_DOORFS_DOOR_RETURN`	doorfs(2) - DOOR_RETURN No information.
257	`AUE_DOORFS_DOOR_REVOKE`	doorfs(2) - DOOR_REVOKE No information.
259	`AUE_DOORFS_DOOR_CRED`	doorfs(2) - DOOR_CRED No information.
261	`AUE_DOORFS_DOOR_UNBIND`	doorfs(2) - DOOR_UNBIND No information.
`514`	`AUE_GETMSGQCMWLABEL`	Table B-61
`515`	`AUE_GETSEMCMWLABEL`	Table B-64
`516`	`AUE_GETSHMCMWLABEL`	Table B-65
`84`	`AUE_MSGCTL`	Illegal command
`85`	`AUE_MSGCTL_RMID`	Table B-84
`86`	`AUE_MSGCTL_SET`	Table B-85
`87`	`AUE_MSGCTL_STAT`	Table B-86
`88`	`AUE_MSGGET`	Table B-87
`174`	`AUE_MSGGETL`	Table B-88
`89`	`AUE_MSGRCV`	Table B-89
`175`	`AUE_MSGRCVL`	Table B-89
`90`	`AUE_MSGSND`	Table B-90
`176`	`AUE_MSGSNDL`	Obsolete.
`98`	`AUE_SEMCTL`	Illegal command
`105`	`AUE_SEMCTL_GETALL`	Table B-120
`102`	`AUE_SEMCTL_GETNCNT`	Table B-121
`103`	`AUE_SEMCTL_GETPID`	Table B-122
`104`	`AUE_SEMCTL_GETVAL`	Table B-123
`106`	`AUE_SEMCTL_GETZCNT`	Table B-124
`99`	`AUE_SEMCTL_RMID`	Table B-125
`100`	`AUE_SEMCTL_SET`	Table B-126
`108`	`AUE_SEMCTL_SETALL`	Table B-127
`107`	`AUE_SEMCTL_SETVAL`	Table B-128
`101`	`AUE_SEMCTL_STAT`	Table B-129
`109`	`AUE_SEMGET`	Table B-130
`177`	`AUE_SEMGETL`	Table B-131
`110`	`AUE_SEMOP`	Table B-132
`517`	`AUE_SEMOPL`	Obsolete.
`96`	`AUE_SHMAT`	Table B-155
`91`	`AUE_SHMCTL`	Placeholder
`92`	`AUE_SHMCTL_RMID`	Table B-157
`93`	`AUE_SHMCTL_SET`	Table B-158
`94`	`AUE_SHMCTL_STAT`	Table B-159
`97`	`AUE_SHMDT`	Table B-160
`95`	`AUE_SHMGET`	Table B-161
`178`	`AUE_SHMGETL`	Table B-162

Events in Audit Class lo

The following table lists in alphabetical order the login or logout class of audit events provided in the Trusted Solaris 8 release.

Table A-15 Login or Logout Audit Events (Default)


Audit Event Number and Event		Where Described
`6165`	`AUE_ftpd`	Table B-258
`6152`	`AUE_login`	Table B-260
`6153`	`AUE_logout`	Table B-263
`6163`	`AUE_passwd`	Table B-270
`6164`	`AUE_rexd`	Table B-282
`6162`	`AUE_rexecd`	Table B-283
`6155`	`AUE_rlogin`	Table B-261
`6158`	`AUE_rshd`	Table B-284
`6159`	`AUE_su`	Table B-294
`6154`	`AUE_telnet`	Table B-262

Events in Audit Class na

The following table lists in alphabetical order the non-attribute class of audit events provided in the Trusted Solaris 8 release.

Table A-16 Non-attribute Audit Events (Default)


Audit Event Number and Event		Where Described
`153`	`AUE_ENTERPROM`	Table B-37
`154`	`AUE_EXITPROM`	Table B-37
`113`	`AUE_SYSTEMBOOT`	Table B-169
`6151`	`AUE_inetd_connect`	Table B-257
`6156`	`AUE_mountd_mount`	Table B-268
`6157`	`AUE_mountd_umount`	Table B-269

Events in Audit Class no

The following table lists in alphabetical order the invalid class class of audit events provided in the Trusted Solaris 8 release.

Table A-17 Invalid Class Audit Events (Default)


Audit Event Number and Event		Where Described
`211`	`AUE_AUDIT`	Table B-8
`209`	`AUE_DUP2`	No longer supported.
`208`	`AUE_FSTAT`	Table B-50
`193`	`AUE_GETDENTS`	Table B-56
`13`	`AUE_JUNK`
`194`	`AUE_LSEEK`	Placeholder
`518`	`AUE_MAC`	No longer supported.
`210`	`AUE_MMAP`	Table B-77
`242`	`AUE_MODCTL`	Placeholder
`197`	`AUE_NFS`	Placeholder
`0`	`AUE_NULL`	Indirect system call

`185`	`AUE_PIPE`	Table B-106
`527`	`AUE_PREADL`	Table B-107
`528`	`AUE_PWRITEL`	Table B-184
`192`	`AUE_READ`	Table B-114
`558`	`AUE_READL`	Table B-114
`198`	`AUE_READV`	Placeholder
`559`	`AUE_READVL`	Table B-114
`189`	`AUE_RECV`	Placeholder
`187`	`AUE_SEND`	Placeholder


`186`	`AUE_SOCKETPAIR`	Placeholder
`521`	`AUE_UPRIV`	Table B-187
`195`	`AUE_WRITE`	Table B-183
`196`	`AUE_WRITEV`	Placeholder

Events in Audit Class nt

The following table lists in alphabetical order the network class of audit events provided in the Trusted Solaris 8 release.

Table A-18 Network Audit Events (Default)


Audit Event Number and Event		Where Described
`33`	`AUE_ACCEPT`	No longer supported.
`34`	`AUE_BIND`	No longer supported.
`32`	`AUE_CONNECT`	No longer supported.
`217`	`AUE_GETMSG`	Table B-59
`219`	`AUE_GETPMSG`	Table B-62
`173`	`AUE_ONESIDE`	No longer supported.
`216`	`AUE_PUTMSG`	Table B-111
`218`	`AUE_PUTPMSG`	Table B-113
`191`	`AUE_RECVFROM`	Format unavailable.
`190`	`AUE_RECVMSG`	Table B-116
`188`	`AUE_SENDMSG`	Table B-133
`184`	`AUE_SENDTO`	Table B-134
`35`	`AUE_SETSOCKOPT`	Table B-153
`247`	`AUE_SOCKACCEPT`	Table B-60
`248`	`AUE_SOCKCONNECT`	Table B-112
`183`	`AUE_SOCKET`	Table B-164
`250`	`AUE_SOCKRECEIVE`	Table B-60
`249`	`AUE_SOCKSEND`	Table B-112
`534`	`AUE_TNIF`	Table B-170
`535`	`AUE_TNRH`
`536`	`AUE_TNRHTP`
`537`	`AUE_TOKMAPPER`	Table B-171

Events in Audit Class ot

The following table lists in alphabetical order the other class of audit events provided in the Trusted Solaris 8 release.

Table A-19 Other Audit Events (Default)


Audit Event Number and Event		Where Described
`238`	`AUE_MEMCNTL`	Table B-73

Events in Audit Class pm

The following table lists in alphabetical order the process modify class of audit events provided in the Trusted Solaris 8 release.

Table A-20 Process Modify Audit Events (Default)


Audit Event Number and Event		Where Described
`24`	`AUE_CHROOT`	Table B-31
`1`	`AUE_EXIT`	Table B-39
`68`	`AUE_FCHDIR`	Table B-41
`69`	`AUE_FCHROOT`	Table B-44
`15`	`AUE_KILL`	Table B-68
`52`	`AUE_KILLPG`	No longer supported.
`203`	`AUE_NICE`	Table B-92
`204`	`AUE_OSETPGRP`	No information.
`200`	`AUE_OSETUID`	No longer supported.
`212`	`AUE_PRIOCNTLSYS`	Table B-108
`214`	`AUE_SETEGID`	Table B-142
`215`	`AUE_SETEUID`	Table B-143
`526`	`AUE_SETPATTR`	Table B-147
`205`	`AUE_SETGID`	Table B-142
`26`	`AUE_SETGROUPS`	Table B-146
`27`	`AUE_SETPGRP`	Table B-148
`31`	`AUE_SETPRIORITY`	No longer supported.
`41`	`AUE_SETREGID`	Table B-150
`40`	`AUE_SETREUID`	Table B-151
200	`AUE_SETUID -`event name is `AUE_OSETUID`	Table B-154
`36`	`AUE_VTRACE`	Table B-182

Events in Audit Class ps

The following table lists in alphabetical order the process start/stop class of audit events provided in the Trusted Solaris 8 release.

Table A-21 Process Start/Stop Audit Events (Default)


Audit Event Number and Event		Where Described
`7`	`AUE_EXEC`	Table B-38
`23`	`AUE_EXECVE`	Table B-38
`2`	`AUE_FORK`	Table B-47
`241`	`AUE_FORK1`	Table B-47
`526`	`AUE_SETPATTR`	Table B-147
`25`	`AUE_VFORK`	Table B-181
`9027`	`AUE_psradm`	Table B-279

Events in Audit Class as

The following table lists in alphabetical order the system-wide administration class of audit events provided in the Trusted Solaris 8 release.

Table A-22 System-wide Administration Audit Events (Default)


Audit Event Number and Event		Where Described
`18`	`AUE_ACCT`	Table B-6
`50`	`AUE_ADJTIME`	Table B-7
`57`	`AUE_ASYNC_DAEMON`	async_daemon(2) No information.
`114`	`AUE_ASYNC_DAEMON_EXIT`	async_daemon(2) No information.
`538`	`AUE_CHSTATE`	Table B-32
`513`	`AUE_CLOCK_SETTIME`	Table B-33
`531`	`AUE_DRVPOLICY`	Table B-36
264	`AUE_INST_SYNC`	inst_sync(2) No information.
`246`	`AUE_MODADDMAJ`	Table B-78
`245`	`AUE_MODCONFIG`	Table B-79
`243`	`AUE_MODLOAD`	Table B-80
`244`	`AUE_MODUNLOAD`	Table B-81
`533`	`AUE_PRIVENABLE`	Table B-109
`540`	`AUE_REMOUNT`	Table B-174
`59`	`AUE_SETDOMAINNAME`	setdomainname(2) No information.
`29`	`AUE_SETHOSTNAME`	sethostname(2) No information.
`51`	`AUE_SETRLIMIT`	Table B-152
`37`	`AUE_SETTIMEOFDAY`	settimeofday(2) No information.
`201`	`AUE_STIME`	Table B-166
`28`	`AUE_SWAPON`	swapon(2) No information.
`239`	`AUE_SYSINFO`	Table B-168
`9018`	`AUE_add_drv`	Table B-228
`9025`	`AUE_dispadmin`	Table B-250
`9032`	`AUE_eeprom`	Table B-252
`9042`	`AUE_installf`	Table B-259
`9020`	`AUE_modload`	Table B-267
`9021`	`AUE_modunload`	Table B-267
`9026`	`AUE_pbind`	Table B-271
`9040`	`AUE_pkginstall`	Table B-273
`9041`	`AUE_pkgremove`	Table B-274
`9027`	`AUE_psradm`	Table B-279
`9019`	`AUE_rem_drv`	Table B-285
`9043`	`AUE_removef`	Table B-281
`9022`	`AUE_setuname`	Table B-291
`9030`	`AUE_swap`	Table B-295
`9024`	`AUE_uname_set`	Table B-299

Events in Audit Class ss

The following table lists in alphabetical order the change system state class of audit events provided in the Trusted Solaris 8 release.

Table A-23 Change System State Audit Events (Default)


Audit Event Number and Event		Where Described
`539`	`AUE_FREEZE`	Table B-172
`561`	`AUE_REBOOT`	Table B-173
`560`	`AUE_SHUTDOWN`	Table B-175
`6160`	`AUE_halt_solaris`	Table B-255
`6161`	`AUE_reboot_solaris`	Table B-280
`9028`	`AUE_run_level_change`	Table B-286
`9023`	`AUE_uadmin_cmd`	Table B-296

Events in Audit Class ax

The following table lists in alphabetical order the ax class of audit events provided in the Trusted Solaris 8 release.

Table A-24 X Server Audit Events - Remainder (Default)


Audit Event Number and Event		Where Described
`9039`	`AUE_sel_mgr_xfer`	Table B-287

Events in Audit Class xa

The following table lists in alphabetical order the xa class of audit events provided in the Trusted Solaris 8 release. This class contains X protocols that use "default" client privileges to succeed. These privileges are listed in the file /usr/openwin/server/tsol/config.privs. The security administrator can remove privileges from this file.

Table A-25 X - Allowed Information Flows Audit Events (Default)


Audit Event Number and Event		Where Described
`9194`	`AUE_ChangeHosts`	Table B-224
`9137`	`AUE_GrabServer`	Table B-199
`9183`	`AUE_InstallColormap`	Table B-215
`9146`	`AUE_SetFontPath`	Table B-205
`9138`	`AUE_UngrabServer`	Table B-199

Events in Audit Class xc

The following table lists lists in alphabetical order the xc class of audit events provided in the Trusted Solaris 8 release. This class contains audit events about the creation and destruction of X server objecte.

Table A-26 X - Object Create/Destroy Operations Audit Events (Default)


Audit Event Number and Event		Where Described
`9176`	`AUE_AllocColor`	Table B-214
`9178`	`AUE_AllocColorCells`
`9179`	`AUE_AllocColorPlanes`
`9177`	`AUE_AllocNamedColor`
`9120`	`AUE_ChangeProperty`	Table B-191
`9170`	`AUE_CreateColormap`	Table B-213
`9185`	`AUE_CreateCursor`	Table B-217
`9186`	`AUE_CreateGlyphCursor`	Table B-218
`9103`	`AUE_CreateWindow`	Table B-190
`9121`	`AUE_DeleteProperty`	Table B-191
`9107`	`AUE_DestroySubwindows`	Table B-190
`9106`	`AUE_DestroyWindow`
`9171`	`AUE_FreeColormap`	Table B-215
`9180`	`AUE_FreeColors`	Table B-214
`9187`	`AUE_FreeCursor`	Table B-219
`9152`	`AUE_FreeGC`	Table B-208
`9147`	`AUE_FreePixmap`	Table B-220
`9197`	`AUE_KillClient`	Table B-224

Events in Audit Class xl

The following table lists in alphabetical order the xl audit events provided in the Trusted Solaris 8 release.

Table A-27 X - Client Login/Logout Audit Events (Default)


Audit Event Number and Event		Where Described
`9101`	`AUE_ClientConnect`	Table B-188
`9102`	`AUE_ClientDisConnect`	Table B-189

Events in Audit Class xp

The following table lists in alphabetical order the xp audit events provided in the Trusted Solaris 8 release.

Table A-28 X - Privileged Audit Events (Default)


Audit Event Number and Event		Where Described
`9148`	`AUE_ChangeGc`	Table B-206
`9120`	`AUE_ChangeProperty`	Table B-191
`9108`	`AUE_ChangeSaveSet`	Table B-190
`9104`	`AUE_ChangeWindowAttributes`
`9115`	`AUE_CirculateWindow`
`9114`	`AUE_ConfigureWindow`
`9172`	`AUE_CopyColormapAndFree`	Table B-215
`9149`	`AUE_CopyGC`	Table B-207
`9161`	`AUE_FillPolygon`	Table B-211
`9199`	`AUE_ForceScreenSaver`	Table B-222
`9116`	`AUE_GetGeometry`	Table B-190
`9140`	`AUE_GetMotionEvents`	Table B-201
`9122`	`AUE_GetProperty`	Table B-191
`9105`	`AUE_GetWindowAttributes`	Table B-190
`9130`	`AUE_GrabButton`	Table B-194
`9135`	`AUE_GrabKey`	Table B-197
`9133`	`AUE_GrabKeyboard`	Table B-198
`9128`	`AUE_GrabPointer`	Table B-195
`9168`	`AUE_ImageText8`	Table B-212
`9169`	`AUE_ImageText16`	Table B-212
`9173`	`AUE_InstallColormap`	Table B-215
`9123`	`AUE_ListProperties`	Table B-191
`9184`	`AUE_LookupColor`	Table B-216
`9111`	`AUE_MapSubwindows`	Table B-190
`9110`	`AUE_MapWindow`
`9160`	`AUE_PolyArc`	Table B-211
`9163`	`AUE_PolyFillArc`
`9162`	`AUE_PolyFillRectangle`
`9157`	`AUE_PolyLine`
`9156`	`AUE_PolyPoint`
`9158`	`AUE_PolySegment`
`9166`	`AUE_PolyText8`	Table B-212
`9167`	`AUE_PolyText16`
`9164`	`AUE_PutImage`
`9183`	`AUE_QueryColors`	Table B-216
`9145`	`AUE_QueryKeymap`	Table B-204
`9139`	`AUE_QueryPointer`	Table B-200
`9117`	`AUE_QueryTree`	Table B-190
`9188`	`AUE_RecolorCursor`	Table B-219
`9109`	`AUE_ReparentWindow`	Table B-190
`9198`	`AUE_RotateProperties`	Table B-225
`9195`	`AUE_SetAccessControl`	Table B-224
`9151`	`AUE_SetClipRectangles`	Table B-208
`9150`	`AUE_SetDashes`	Table B-208
`9193`	`AUE_SetScreenSaver`	Table B-222
`9124`	`AUE_SetSelectionOwner`	Table B-193
`9181`	`AUE_StoreColors`	Table B-216
`9182`	`AUE_StoreNamedColor`	Table B-216
`9141`	`AUE_TranslateCoords`	Table B-202
`9136`	`AUE_UngrabKey`	Table B-198
`9174`	`AUE_UninstallColormap`	Table B-215
`9113`	`AUE_UnmapSubwindows`	Table B-190
`9112`	`AUE_UnmapWindow`
`9202`	`AUE_XExtensions`	Table B-227

Events in Audit Class xs

The following table lists in alphabetical order the xs audit events provided in the Trusted Solaris 8 release.

Note -

These events should be audited for success only, not for failure.

Table A-29 X - Fail Silently Audit Events (Default)


Audit Event Number and Event		Where Described
`9193`	`AUE_Bell`	Table B-221
`9132`	`AUE_ChangeActivePointerGrab`	Table B-196
`9190`	`AUE_ChangeKeyboardControl`	Table B-221
`9189`	`AUE_ChangeKeyboardMapping`
`9192`	`AUE_ChangePointerControl`
`9126`	`AUE_ConvertSelection`	Table B-193
`9154`	`AUE_CopyArea`	Table B-210
`9155`	`AUE_CopyPlane`
`9119`	`AUE_GetAtomName`	Table B-192
`9165`	`AUE_GetImage`	Table B-212
`9144`	`AUE_GetInputFocus`	Table B-203
`9125`	`AUE_GetSelectionOwner`	Table B-193
`9128`	`AUE_GrabPointer`	Table B-195
`9118`	`AUE_InternAtom`	Table B-192
`9175`	`AUE_ListInstalledColormap`	Table B-215
`9159`	`AUE_PolyRectangle`	Table B-211
`9127`	`AUE_SendEvent`	Table B-201
`9196`	`AUE_SetCloseDownMode`	Table B-223
`9143`	`AUE_SetInputFocus`	Table B-203
`9201`	`AUE_SetModifierMapping`	Table B-226
`9200`	`AUE_SetPointerMapping`	Table B-226
`9124`	`AUE_SetSelectionOwner`	Table B-193
`9134`	`AUE_UngrabKeyboard`	Table B-197
`9129`	`AUE_UngrabPointer`	Table B-195
`9131`	`AUE_UngrabButton`	Table B-195
`9142`	`AUE_WarpPointer`	Table B-202