*nix Documentation Project
·  Home
 +   man pages
·  Linux HOWTOs
·  FreeBSD Tips
·  *niX Forums

  man pages->IRIX man pages -> sat_select (1)              


sat_select(1M)							sat_select(1M)

NAME    [Toc]    [Back]

     sat_select	- preselect events for the system audit	trail to gather

SYNOPSIS    [Toc]    [Back]

     sat_select	[ -h ] [ idtype	] [ -out ] [ -clearall | -out |
     -on | -off	(all | event) ]	[ -copy	id ]

     sat_select	[ filetype ] filename

DESCRIPTION    [Toc]    [Back]

     sat_select	directs	the system audit trail to collect records of a
     particular	idtype describing certain events and to	ignore records
     describing	certain	other events.  Note that if no idtype is specified,
     then the events will be default to	global event mask.  sat_select with no
     arguments lists the audit events currently	being collected.

     The effect	of multiple executions of sat_select is	cumulative.

     The auditable event types are described in	the IRIX Admin:	Backup,
     Security, and Accounting.	For a brief, online description, see the
     comments in /usr/include/sys/sat.h.

     See audit(1M) or the IRIX Admin: Backup, Security,	and Accounting guide
     for more information on configuring the audit subsystem.

     If	the audit daemon, satd(1M), isn't running, sat_select does not select
     any audit events for auditing.  This is to	prevent	inadvertently halting
     the system, which can happen if an	audit daemon is	not running to remove
     events from the queue.

OPTIONS    [Toc]    [Back]

     -h		  Help is provided.  The names of all possible audit events
		  are displayed.

     idtype	  Is one of the	followings:
		   -sg|-og gid|name   subject|object group
		   -su|-ou uid|name   subject|object user id
		   -sm|-om mac_label  subject|object mac label
		  No idtype defaults to	global event mask.

     -out	  Print	the names of all active	audit events for idtype.  The
		  event	names are displayed in the same	format that sat_select
		  uses for its command line arguments.

     -on all|event
		  Select the auditing events for a particular idtype. The
		  format of the	event string is	defined	in the
		  sat_eventtostr(3) reference page.  If	all is given as	the
		  event	string,	all event types	are selected.

									Page 1

sat_select(1M)							sat_select(1M)

     -off all|event
		  Ignore records containing the	specified audit	event of a
		  certain idtype. The format of	the event string is defined in
		  the sat_eventtostr(3)	reference page.	 If all	is given as
		  the event string, all	event types are	ignored.

     -copy id	  Copy the event mask from id to idtype.

     -clearall	  Clears all active auditing event masks (global and id

     filetype filename
		  Set events from filename for the filetype:
		   -F  global events
		   -SG subject gid events
		   -SM subject label events
		   -SU subject user events
		   -OG object gid events
		   -OM object label events
		   -OU object user events
		  The file format for all except the global event file will
		       <id> [<id>...]: -{-on|-off} event ...
		  The global event file	will remain the	same with only the
		  events lists.	A special event	case of	all will also be
		  accepted in all files, ie. -F	global events

FILES    [Toc]    [Back]

     /etc/init.d/audit	 system	audit startup script
     /etc/config/audit	 configuration file, on	if auditing is enabled
			 optional file for site-dependent sat_select options

EXAMPLES    [Toc]    [Back]

     To	collect	records	describing all System V	IPC events (creation, change,
     access, or	removal	of semaphores, message queues, and shared memory
     segments),	in addition to whatever	events were previously selected	for
     collection, give this command:

	       sat_select -on sat_svipc_create -on sat_svipc_change \
	       -on sat_svipc_access -on	sat_svipc_remove

     To	ignore records describing all events, regardless of what may have been
     previously	selected, but to collect records initiated by trusted
     administrative programs such as login and su, give	this command:

	       sat_select -off all -on sat_ae_audit -on	sat_ae_identity	\
	       -on sat_ae_custom

									Page 2

sat_select(1M)							sat_select(1M)

     To	save the current audit state in	a file that sat_select can read:

	       sat_select -out > /etc/config/sat_select.options

     To	restore	the audit state	from a previously saved	file:

	       sat_select `cat /etc/config/sat_select.options`

     To	read the subject user options from the configuration file:

	       sat_select -SU guest filename

SEE ALSO    [Toc]    [Back]

     sat_interpret(1M),	sat_reduce(1M),	sat_summarize(1M), satd(1M),
     satctl(2),	sat_eventtostr(3).

     IRIX Admin: Backup, Security, and Accounting

									PPPPaaaaggggeeee 3333
[ Back ]
 Similar pages
Name OS Title
satconfig IRIX configure the system audit trail to collect particular events
satd IRIX reliably save the system audit trail
sat_reduce IRIX filter interesting records from the system audit trail
audit IRIX system audit trail startup and shutdown script
sat_echo IRIX echo standard input into the system audit trail
audeventsta HP-UX define and describe audit system events
dcecp_audtrail HP-UX A dcecp object that converts the audit trail into a readable format
aud_audit_events HP-UX Auditable events for the audit services
dcecp_audevents HP-UX A dcecp object that lists audit events on a DCE host
sysfs Tru64 gather information about file system types
Copyright © 2004-2005 DeniX Solutions SRL
newsletter delivery service