Modifying audit masks
About this task
The DBSSO can modify masks individually from the command line.
To modify audit masks:
Procedure
Use the -m option of the onaudit utility
to modify a single mask. You can use this option to use another mask
as a base to add or remove individual audit events.
To
modify several masks at a time, you can create a new input file, change
the appropriate masks, and reload them in the mask table.
The following example shows how to modify the user mask
pat.
The _guest template mask forms a base from which
a complete set of audit events is drawn. Settings for specific events
from that file are then superseded by the events listed as arguments
to the -e option. onaudit -m -u pat -r _guest -e +ALTB,USTBWhen you supply a base mask with the -r option, you replace all the audit events in the initial mask. When you change only a few events in a mask, you might not want to specify a base mask. For the syntax and another example of how to modify a mask, see The onaudit utility: Configure audit masks.