Commit | Line | Data |
---|---|---|
805e021f CE |
1 | * Copyright 2000, International Business Machines Corporation and others. |
2 | * All Rights Reserved. | |
3 | * | |
4 | * This software has been released under the terms of the IBM Public | |
5 | * License. For details, see the LICENSE file in the top-level source | |
6 | * directory or online at http://www.openafs.org/dl/license10.html | |
7 | ||
8 | * In order for AFS events to be recorded by the AIX auditing facility, | |
9 | * the events must be declared within the "/etc/security/audit/events" | |
10 | * file. This file contains all of the AFS audit events, and needs to | |
11 | * be appended to the "/etc/security/audit/events" file. | |
12 | ||
13 | * AFS events - Audit | |
14 | ||
15 | * /usr/afs/local/Audit: | |
16 | AFS_Audit_WR = printf "%s" | |
17 | ||
18 | AFS_Aud_On = printf "ECode=%d" | |
19 | AFS_Aud_Off = printf "ECode=%d" | |
20 | AFS_Aud_EINVAL = printf "Event=%s" | |
21 | AFS_Aud_Unauth = printf "ECode=%d Event=%s" | |
22 | AFS_Aud_NoAFSId = printf "ECode=%d Event=%s" | |
23 | AFS_Aud_UnknSec = printf "ECode=%d Event=%s" | |
24 | AFS_Aud_NoCall = printf "ECode=%d Event=%s" | |
25 | AFS_Aud_NoConn = printf "ECode=%d Event=%s" | |
26 | AFS_Aud_NoHost = printf "ECode=%d Event=%s" | |
27 | ||
28 | * AFS events - BUDB | |
29 | AFS_BUDB_Start = printf "ECode=%d" | |
30 | AFS_BUDB_Finish = printf "ECode=%d" | |
31 | AFS_BUDB_Exit = printf "ECode=%d" | |
32 | AFS_BUDB_UseTpe = printf "ECode=%d AFSName=%s HostID=0x%x dumpId=%u" | |
33 | AFS_BUDB_FinTpe = printf "ECode=%d AFSName=%s HostID=0x%x dumpId=%u" | |
34 | AFS_BUDB_DelTpe = printf "ECode=%d AFSName=%s HostID=0x%x dumpId=%u" | |
35 | AFS_BUDB_CrDmp = printf "ECode=%d AFSName=%s HostID=0x%x dumpId=%u" | |
36 | AFS_BUDB_FinDmp = printf "ECode=%d AFSName=%s HostID=0x%x dumpId=%u" | |
37 | AFS_BUDB_DelDmp = printf "ECode=%d AFSName=%s HostID=0x%x dumpId=%u" | |
38 | AFS_BUDB_LstDmp = printf "ECode=%d AFSName=%s HostID=0x%x SearchFlags=%u" | |
39 | AFS_BUDB_AppDmp = printf "ECode=%d AFSName=%s HostID=0x%x dumpId=%u" | |
40 | AFS_BUDB_FnLTpe = printf "ECode=%d AFSName=%s HostID=0x%x dumpId=%u" | |
41 | AFS_BUDB_AddVol = printf "ECode=%d AFSName=%s HostID=0x%x volId=%u" | |
42 | AFS_BUDB_GetTpe = printf "ECode=%d AFSName=%s HostID=0x%x" | |
43 | AFS_BUDB_GetDmp = printf "ECode=%d AFSName=%s HostID=0x%x" | |
44 | AFS_BUDB_GetVol = printf "ECode=%d AFSName=%s HostID=0x%x" | |
45 | AFS_BUDB_DelVDP = printf "ECode=%d AFSName=%s HostID=0x%x dumpSetName=%s" | |
46 | AFS_BUDB_FndCln = printf "ECode=%d AFSName=%s HostID=0x%x volName=%s" | |
47 | AFS_BUDB_FndDmp = printf "ECode=%d AFSName=%s HostID=0x%x volName=%s" | |
48 | AFS_BUDB_FndLaD = printf "ECode=%d AFSName=%s HostID=0x%x volName=%s" | |
49 | AFS_BUDB_DmpDB = printf "ECode=%d AFSName=%s HostID=0x%x" | |
50 | AFS_BUDB_RstDBH = printf "ECode=%d AFSName=%s HostID=0x%x" | |
51 | AFS_BUDB_DBVfy = printf "ECode=%d AFSName=%s HostID=0x%x" | |
52 | AFS_BUDB_GetTxt = printf "ECode=%d AFSName=%s HostID=0x%x Type=%d" | |
53 | AFS_BUDB_GetTxV = printf "ECode=%d AFSName=%s HostID=0x%x Type=%d" | |
54 | AFS_BUDB_SavTxt = printf "ECode=%d AFSName=%s HostID=0x%x Type=%d" | |
55 | AFS_BUDB_FrALck = printf "ECode=%d AFSName=%s HostID=0x%x" | |
56 | AFS_BUDB_FreLck = printf "ECode=%d AFSName=%s HostID=0x%x" | |
57 | AFS_BUDB_GetIId = printf "ECode=%d AFSName=%s HostID=0x%x" | |
58 | AFS_BUDB_GetLck = printf "ECode=%d AFSName=%s HostID=0x%x" | |
59 | AFS_BUDB_TGetVr = printf "ECode=%d AFSName=%s HostID=0x%x" | |
60 | AFS_BUDB_TDmpHa = printf "ECode=%d AFSName=%s HostID=0x%x file=/tmp/%s" | |
61 | AFS_BUDB_TDmpDB = printf "ECode=%d AFSName=%s HostID=0x%x file=/tmp/%s" | |
62 | ||
63 | * AFS events - PTServer | |
64 | AFS_PTS_Start = printf "ECode=%d" | |
65 | AFS_PTS_Finish = printf "ECode=%d" | |
66 | AFS_PTS_Exit = printf "ECode=%d" | |
67 | AFS_PTS_INewEnt = printf "ECode=%d AFSName=%s HostID=0x%x GroupId=%d Name=%s OwnerId=%d" | |
68 | AFS_PTS_NewEnt = printf "ECode=%d AFSName=%s HostID=0x%x GroupId=%d Name=%s OwnerId=%d" | |
69 | AFS_PTS_LstEnt = printf "ECode=%d AFSName=%s HostID=0x%x GroupId=%d" | |
70 | AFS_PTS_ChgEnt = printf "ECode=%d AFSName=%s HostID=0x%x GroupId=%d NewName=%s NewOwnerId=%d NewId=%d" | |
71 | AFS_PTS_SetFEnt = printf "ECode=%d AFSName=%s HostID=0x%x GroupId=%d" | |
72 | AFS_PTS_LstOwn = printf "ECode=%d AFSName=%s HostID=0x%x GroupId=%d" | |
73 | AFS_PTS_LstEle = printf "ECode=%d AFSName=%s HostID=0x%x GroupId=%d" | |
74 | AFS_PTS_LstMax = printf "ECode=%d AFSName=%s HostID=0x%x" | |
75 | AFS_PTS_SetMax = printf "ECode=%d AFSName=%s HostID=0x%x GroupId=%d flag=%d" | |
76 | AFS_PTS_Del = printf "ECode=%d AFSName=%s HostID=0x%x GroupId=%d" | |
77 | AFS_PTS_AdToGrp = printf "ECode=%d AFSName=%s HostID=0x%x GroupId=%d UserId=%d" | |
78 | AFS_PTS_RmFmGrp = printf "ECode=%d AFSName=%s HostID=0x%x GroupId=%d UserId=%d" | |
79 | AFS_PTS_IsMemOf = printf "ECode=%d AFSName=%s HostID=0x%x UserId=%d GroupId=%d" | |
80 | AFS_PTS_NmToId = printf "ECode=%d AFSName=%s HostID=0x%x" | |
81 | AFS_PTS_IdToNm = printf "ECode=%d AFSName=%s HostID=0x%x GroupId=%d" | |
82 | AFS_PTS_GetCPS = printf "ECode=%d AFSName=%s HostID=0x%x GroupId=%d" | |
83 | AFS_PTS_GetCPS2 = printf "ECode=%d AFSName=%s HostID=0x%x GroupId=%d Host=0x%x" | |
84 | AFS_PTS_GetHCPS = printf "ECode=%d AFSName=%s HostID=0x%x Host=0x%x" | |
85 | AFS_PTS_WheIsIt = printf "ECode=%d AFSName=%s HostID=0x%x GroupId=%s Position=%d" | |
86 | AFS_PTS_DmpEnt = printf "ECode=%d AFSName=%s HostID=0x%x Position=%d" | |
87 | ||
88 | * AFS events - volserver | |
89 | AFS_VS_Start = printf "ECode=%d" | |
90 | AFS_VS_Finish = printf "ECode=%d" | |
91 | AFS_VS_Exit = printf "ECode=%d" | |
92 | AFS_VS_TransCr = printf "ECode=%d AFSName=%s HostID=0x%x Trans=%d VolID=%u" | |
93 | AFS_VS_EndTrn = printf "ECode=%d AFSName=%s HostID=0x%x Trans=%d" | |
94 | AFS_VS_CrVol = printf "ECode=%d AFSName=%s HostID=0x%x Trans=%d VolID=%u VolName=%s Type=%d ParentID=%d" | |
95 | AFS_VS_DelVol = printf "ECode=%d AFSName=%s HostID=0x%x Trans=%d" | |
96 | AFS_VS_NukVol = printf "ECode=%d AFSName=%s HostID=0x%x VolID=%u" | |
97 | AFS_VS_Dump = printf "ECode=%d AFSName=%s HostID=0x%x Trans=%d" | |
98 | AFS_VS_SigRst = printf "ECode=%d AFSName=%s HostID=0x%x VolName=%s" | |
99 | AFS_VS_Restore = printf "ECode=%d AFSName=%s HostID=0x%x Trans=%d" | |
100 | AFS_VS_Forward = printf "ECode=%d AFSName=%s HostID=0x%x FromTrans=%d Host=%d DestTrans=%d" | |
101 | AFS_VS_Clone = printf "ECode=%d AFSName=%s HostID=0x%x Trans=%d Purge=%d NewName=%s NewType=%d NewVolID=%u" | |
102 | AFS_VS_ReClone = printf "ECode=%d AFSName=%s HostID=0x%x Trans=%d CloneVolID=%u" | |
103 | AFS_VS_SetForw = printf "ECode=%d AFSName=%s HostID=0x%x Trans=%d NewHost=0x%x" | |
104 | AFS_VS_GetFlgs = printf "ECode=%d AFSName=%s HostID=0x%x Trans=%d" | |
105 | AFS_VS_SetFlgs = printf "ECode=%d AFSName=%s HostID=0x%x Trans=%d Flags=%d" | |
106 | AFS_VS_GetName = printf "ECode=%d AFSName=%s HostID=0x%x Trans=%d" | |
107 | AFS_VS_GetStat = printf "ECode=%d AFSName=%s HostID=0x%x Trans=%d" | |
108 | AFS_VS_SetIdTy = printf "ECode=%d AFSName=%s HostID=0x%x Trans=%d VolName=%s Type=%d ParentId=%d CloneID=%d BackupID=%d" | |
109 | AFS_VS_SetDate = printf "ECode=%d AFSName=%s HostID=0x%x Trans=%d Date=%d" | |
110 | AFS_VS_ListPar = printf "ECode=%d AFSName=%s HostID=0x%x" | |
111 | AFS_VS_ParInf = printf "ECode=%d AFSName=%s HostID=0x%x PartName=%s" | |
112 | AFS_VS_ListVol = printf "ECode=%d AFSName=%s HostID=0x%x" | |
113 | AFS_VS_XLstVol = printf "ECode=%d AFSName=%s HostID=0x%x" | |
114 | AFS_VS_Lst1Vol = printf "ECode=%d AFSName=%s HostID=0x%x VolID=%u" | |
115 | AFS_VS_XLst1Vl = printf "ECode=%d AFSName=%s HostID=0x%x VolID=%u" | |
116 | AFS_VS_GetNVol = printf "ECode=%d AFSName=%s HostID=0x%x VolID=%u" | |
117 | AFS_VS_Monitor = printf "ECode=%d AFSName=%s HostID=0x%x" | |
118 | AFS_VS_SetInfo = printf "ECode=%d AFSName=%s HostID=0x%x Trans=%d" | |
119 | ||
120 | * AFS events - authentication | |
121 | AFS_KAA_ChPswd = printf "ECode=%d AFSName=%s HostID=0x%x name=%s instance=%s" | |
122 | AFS_KAA_AuthO = printf "ECode=%d AFSName=%s HostID=0x%x name=%s instance=%s" | |
123 | AFS_KAA_Auth = printf "ECode=%d AFSName=%s HostID=0x%x name=%s instance=%s" | |
124 | ||
125 | AFS_KAT_GetTkt = printf "ECode=%d AFSName=%s HostID=0x%x name=%s instance=%s" | |
126 | AFS_KAT_GetTktO = printf "ECode=%d AFSName=%s HostID=0x%x name=%s instance=%s" | |
127 | ||
128 | AFS_KAM_CrUser = printf "ECode=%d AFSName=%s HostID=0x%x name=%s instance=%s" | |
129 | AFS_KAM_DelUser = printf "ECode=%d AFSName=%s HostID=0x%x name=%s instance=%s" | |
130 | AFS_KAM_SetPswd = printf "ECode=%d AFSName=%s HostID=0x%x name=%s instance=%s" | |
131 | AFS_KAM_LstEnt = printf "ECode=%d AFSName=%s HostID=0x%x index=%d" | |
132 | AFS_KAM_GetPswd = printf "ECode=%d AFSName=%s HostID=0x%x name=%s" | |
133 | AFS_KAM_Dbg = printf "ECode=%d AFSName=%s HostID=0x%x" | |
134 | AFS_KAM_SetFld = printf "ECode=%d AFSName=%s HostID=0x%x name=%s instance=%s flags=%u date=%u lifetime=%u maxAssoc=%u" | |
135 | AFS_KAM_GetStat = printf "ECode=%d AFSName=%s HostID=0x%x" | |
136 | AFS_KAM_GetEnt = printf "ECode=%d AFSName=%s HostID=0x%x name=%s instance=%s" | |
137 | AFS_KAM_GRnKey = printf "ECode=%d AFSName=%s HostID=0x%x" | |
138 | ||
139 | AFS_UnAth = printf "ECode=%d AFSName=%s HostID=0x%x name=%s instance=%s cell=%s" | |
140 | AFS_UseOfPriv = printf "ECode=%d AFSName=%s HostID=0x%x name=%s instance=%s cell=%s" | |
141 | AFS_UnlockUser = printf "ECode=%d AFSName=%s HostID=0x%x name=%s instance=%s" | |
142 | AFS_LockStatus = printf "ECode=%d AFSName=%s HostID=0x%x name=%s instance=%s" | |
143 | AFS_UDPAuth = printf "ECode=%d name=%s instance=%s" | |
144 | AFS_UDPGetTckt = printf "ECode=%d name=%s instance=%s cell=%s name=%s instance=%s" | |
145 | ||
146 | AFS_RunNoAuth = printf "ECode=%d" | |
147 | AFS_NoAuthDsbl = printf "ECode=%d" | |
148 | AFS_NoAuthEnbl = printf "ECode=%d" | |
149 | ||
150 | * AFS events - RX | |
151 | AFS_SRX_FchData = printf "ECode=%d AFSName=%s HostID=0x%x FID=%u %u %u" | |
152 | AFS_SRX_FchACL = printf "ECode=%d AFSName=%s HostID=0x%x FID=%u %u %u" | |
153 | AFS_SRX_BFchSta = printf "ECode=%d AFSName=%s HostID=0x%x FID=%u %u %u" | |
154 | AFS_SRX_FchStat = printf "ECode=%d AFSName=%s HostID=0x%x FID=%u %u %u" | |
155 | AFS_SRX_StData = printf "ECode=%d AFSName=%s HostID=0x%x FID=%u %u %u" | |
156 | AFS_SRX_StACL = printf "ECode=%d AFSName=%s HostID=0x%x FID=%u %u %u" | |
157 | AFS_SRX_StStat = printf "ECode=%d AFSName=%s HostID=0x%x FID=%u %u %u" | |
158 | AFS_SRX_RmFile = printf "ECode=%d AFSName=%s HostID=0x%x FID=%u %u %u name=%s" | |
159 | AFS_SRX_CrFile = printf "ECode=%d AFSName=%s HostID=0x%x FID=%u %u %u name=%s" | |
160 | AFS_SRX_RNmFile = printf "ECode=%d AFSName=%s HostID=0x%x oldFID=%u %u %u oldName=%s newFID=%u %u %u newName=%s" | |
161 | AFS_SRX_SymLink = printf "ECode=%d AFSName=%s HostID=0x%x FID=%u %u %u name=%s" | |
162 | AFS_SRX_Link = printf "ECode=%d AFSName=%s HostID=0x%x FID=%u %u %u name=%s FID=%u %u %u" | |
163 | AFS_SRX_MakeDir = printf "ECode=%d AFSName=%s HostID=0x%x FID=%u %u %u name=%s" | |
164 | AFS_SRX_RmDir = printf "ECode=%d AFSName=%s HostID=0x%x FID=%u %u %u name=%s" | |
165 | AFS_SRX_SetLock = printf "ECode=%d AFSName=%s HostID=0x%x FID=%u %u %u type=%d" | |
166 | AFS_SRX_ExtLock = printf "ECode=%d AFSName=%s HostID=0x%x FID=%u %u %u" | |
167 | AFS_SRX_RelLock = printf "ECode=%d AFSName=%s HostID=0x%x FID=%u %u %u" | |
168 | AFS_SRX_SetVolS = printf "ECode=%d AFSName=%s HostID=0x%x volId=%u volName=%s" | |
169 | AFS_Priv = printf "ECode=%d viceId=%d callRoutine=%d" | |
170 | AFS_PrivSet = printf "ECode=%d viceId=%d callRoutine=%d" | |
171 | ||
172 | * AFS events - BOS server | |
173 | AFS_BOS_SetReSt = printf "ECode=%d AFSName=%s HostID=0x%x" | |
174 | AFS_BOS_Exec = printf "ECode=%d AFSName=%s HostID=0x%x cmd=%s" | |
175 | AFS_BOS_UnInst = printf "ECode=%d AFSName=%s HostID=0x%x name=%s" | |
176 | AFS_BOS_Inst = printf "ECode=%d AFSName=%s HostID=0x%x name=%s" | |
177 | AFS_BOS_SetCell = printf "ECode=%d AFSName=%s HostID=0x%x name=%s" | |
178 | AFS_BOS_AddHst = printf "ECode=%d AFSName=%s HostID=0x%x name=%s" | |
179 | AFS_BOS_DelHst = printf "ECode=%d AFSName=%s HostID=0x%x name=%s" | |
180 | AFS_BOS_AddKey = printf "ECode=%d AFSName=%s HostID=0x%x" | |
181 | AFS_BOS_LstKey = printf "ECode=%d AFSName=%s HostID=0x%x" | |
182 | AFS_BOS_LstKeyU = printf "ECode=%d AFSName=%s HostID=0x%x" | |
183 | AFS_BOS_DelKey = printf "ECode=%d AFSName=%s HostID=0x%x" | |
184 | AFS_BOS_SetNoAu = printf "ECode=%d AFSName=%s HostID=0x%x flag=%d" | |
185 | AFS_BOS_AddSUsr = printf "ECode=%d AFSName=%s HostID=0x%x" | |
186 | AFS_BOS_LstSUsr = printf "ECode=%d AFSName=%s HostID=0x%x" | |
187 | AFS_BOS_DelSUsr = printf "ECode=%d AFSName=%s HostID=0x%x" | |
188 | AFS_BOS_CreBnod = printf "ECode=%d AFSName=%s HostID=0x%x" | |
189 | AFS_BOS_DelBnod = printf "ECode=%d AFSName=%s HostID=0x%x instance=%s" | |
190 | AFS_BOS_StartAl = printf "ECode=%d AFSName=%s HostID=0x%x" | |
191 | AFS_BOS_ReStAll = printf "ECode=%d AFSName=%s HostID=0x%x" | |
192 | AFS_BOS_ShtdAll = printf "ECode=%d AFSName=%s HostID=0x%x" | |
193 | AFS_BOS_WaitAll = printf "ECode=%d AFSName=%s HostID=0x%x" | |
194 | AFS_BOS_ReStart = printf "ECode=%d AFSName=%s HostID=0x%x instance=%s" | |
195 | AFS_BOS_ReBos = printf "ECode=%d AFSName=%s HostID=0x%x" | |
196 | AFS_BOS_ReBosIn = printf "ECode=%d" | |
197 | AFS_BOS_SetTSta = printf "ECode=%d AFSName=%s HostID=0x%x instance=%s" | |
198 | AFS_BOS_SetStat = printf "ECode=%d AFSName=%s HostID=0x%x instance=%s" | |
199 | AFS_BOS_PrnLog = printf "ECode=%d AFSName=%s HostID=0x%x" | |
200 | AFS_BOS_GetLog = printf "ECode=%d AFSName=%s HostID=0x%x" | |
201 | AFS_BOS_DoExec = printf "ECode=%d exec=%s" | |
202 | AFS_BOS_StpProc = printf "ECode=%d cmd=%s" | |
203 | ||
204 | * AFS events - VL Server | |
205 | AFS_VL_CreEnt = printf "ECode=%d AFSName=%s HostID=0x%x name=%s" | |
206 | AFS_VL_DelEnt = printf "ECode=%d AFSName=%s HostID=0x%x volID=%u" | |
207 | AFS_VL_GetNVlID = printf "ECode=%d AFSName=%s HostID=0x%x" | |
208 | AFS_VL_RepEnt = printf "ECode=%d AFSName=%s HostID=0x%x volID=%u" | |
209 | AFS_VL_UpdEnt = printf "ECode=%d AFSName=%s HostID=0x%x volID=%u" | |
210 | AFS_VL_SetLck = printf "ECode=%d AFSName=%s HostID=0x%x volID=%u" | |
211 | AFS_VL_RelLck = printf "ECode=%d AFSName=%s HostID=0x%x volID=%u" |