topic Re: sam log event codes in Operating System - HP-UX

sam log event codes

kirk_11 — Thu, 17 Jul 2003 10:12:36 GMT

I am using sam and have set it up to log a lot of events. I can use the audisp command to view all of the logs. What I need is some sort of key or cross reference so that I can match the "EVENT" code to some meaningful explination of what was logged. Dows anyone know of any such "EVENT" matrix or cross refenence?
Thanks,
Kirk

Re: sam log event codes

Pete Randall — Thu, 17 Jul 2003 10:16:48 GMT

Kirk,

From the man page for audisp:

"-e eventname Display audit information of the specified event types.
The defined event types are admin, close, create,
delete, ipcclose, ipccreat, ipcdgram, ipcopen, login,
modaccess, moddac, open, process, readdac, removable,
uevent1, uevent2, and uevent3 (see audevent(1M))."

Is this what you mean?

Pete

Re: sam log event codes

Pete Randall — Thu, 17 Jul 2003 10:19:18 GMT

Kirk,

Also (as it says) see man audevent(1M).

Pete

Re: sam log event codes

kirk_11 — Thu, 17 Jul 2003 10:22:41 GMT

Pete,
Not exactly... When I view the logs using audisp, I get a bunch of cryptic information including: TIME, PID, E, EVENT, PPID and etc...
What I want to know is how to know exaclty what triggered this log entry. I thought that the EVENT tag in the entry would somehow be able to be crossreferenced to some explanation (in plain language) of what happened.
Thanks,
Kirk

Re: sam log event codes

Ollie R — Thu, 17 Jul 2003 10:42:39 GMT

Hi Kirk,

Please refer to the following 2 files:

/usr/conf/sys/scall_define.h

/usr/conf/sys/audit.h

The first file can be used as a direct x-ref for all event codes below 1000.

The second file can be used to x-ref all other event codes. These are ADMIN codes and must be converted between HEX and DEC to get the correct translation.

E.g: Event "10244" (DECIMAL) in "audisp" translates to "024004" (OCTAL) in "audit.h".

Hope this helps,

Ollie.