Displaying audit masks

About this task

To display all the audit masks and the audit events that each mask contains:

Procedure

Use the -o option of the onaudit utility.

When you issue the onaudit -o -y command, the output (mask name, base mask, audit events) are displayed as follows:

_default     -     UPAM,DRAM
_require     -
_exclude     -
_guest       -     CRDB,GRDB,GRTB
terry        -     -CRDB

You can specify a mask as an argument to the -o option. The following example displays only the mask for user terry:

onaudit -o -u terry

A list of audit masks is helpful when you must modify them. You can use the modified output as an input file to modify a single mask or groups of masks in a single batch. For more information, see Modifying audit masks. For the complete syntax of the onaudit -o option and a description of the output, see The onaudit utility: Configure audit masks.

Tip: If you use a base mask to create or modify a mask, the base mask itself is not displayed in the onaudit -o output for the new mask. If a mask is created or modified with a base mask, it does not refer to the base mask.