Creating a user mask from a template mask

About this task

A mask that is used as the foundation for one or more other masks is a base mask.

To create a user mask from a template mask:

Procedure

Create the template mask. After you create a template mask for a given user category, you can use it as the basis of masks for individual users, adding or removing only the audit events that differ for each user.
The following example creates a user mask for the user terry, based on the _guest template mask:
onaudit -a -u terry -r _guest -e -CRDB

The terry mask has the same audit events as the _guest mask, except for the CRDB (Create Database) audit event, which was removed.

Instead of template masks, you can also use existing user _default, _require, and _exclude masks as base masks.

Tip: If you use a template or user mask as a base mask for another mask, the new mask inherits the events in the base mask. The new mask does not refer to the base mask dynamically. Future changes to the base mask are not reflected in other masks that might have been created or modified with that mask as a base.