sam log event codes

[kirk_11]

I am using sam and have set it up to log a lot of events. I can use the audisp command to view all of the logs. What I need is some sort of key or cross reference so that I can match the "EVENT" code to some meaningful explination of what was logged. Dows anyone know of any such "EVENT" matrix or cross refenence?
Thanks,
Kirk

[Pete Randall]

Kirk,

From the man page for audisp:

"-e eventname Display audit information of the specified event types.
The defined event types are admin, close, create,
delete, ipcclose, ipccreat, ipcdgram, ipcopen, login,
modaccess, moddac, open, process, readdac, removable,
uevent1, uevent2, and uevent3 (see audevent(1M))."


Is this what you mean?


Pete

[Pete Randall]

Kirk,

Also (as it says) see man audevent(1M).


Pete

[kirk_11]

Pete,
Not exactly... When I view the logs using audisp, I get a bunch of cryptic information including: TIME, PID, E, EVENT, PPID and etc...
What I want to know is how to know exaclty what triggered this log entry. I thought that the EVENT tag in the entry would somehow be able to be crossreferenced to some explanation (in plain language) of what happened.
Thanks,
Kirk

[Ollie R]

Hi Kirk,

Please refer to the following 2 files:

/usr/conf/sys/scall_define.h

/usr/conf/sys/audit.h

The first file can be used as a direct x-ref for all event codes below 1000.

The second file can be used to x-ref all other event codes. These are ADMIN codes and must be converted between HEX and DEC to get the correct translation.

E.g: Event "10244" (DECIMAL) in "audisp" translates to "024004" (OCTAL) in "audit.h".

Hope this helps,

Ollie.