AUDIT_EVENT(5)

🎀 AUDIT_EVENT(5) — bestie's guide to audit event descriptions 🎀

okay so this one is from the File Formats Manual section, page AUDIT_EVENT(5), and it's literally the master list of every auditable thing on your system. buckle up 💖

---

✨ NAME ✨

audit_event — the file that holds the descriptions of all the audit events, no cap.

---

🦋 DESCRIPTION 🦋

so the audit_event file contains descriptions of the auditable events on the system. like, every event your audit system could possibly care about gets a little line in here. every single line maps an audit event number to a name, a description, and a class. it's giving very organized, very demure 🎀

each entry is literally this shape, exactly:

eventnum:eventname:description:eventclass

and here's the important part, bestie: each eventclass should have a corresponding entry in the audit_class(5) file. the way that these two files are in a whole committed relationship 💅 if your class isn't in audit_class(5), that vibe check fails.

example entries in this file are, verbatim, icons only:

0:AUE_NULL:indir system call:no
1:AUE_EXIT:exit(2):pc
2:AUE_FORK:fork(2):pc
3:AUE_OPEN:open(2):fa

see how each one is doing the eventnum:eventname:description:eventclass thing? chef's kiss. 🔥

---

🌸 FILES 🌸

• /etc/security/audit_event — this is the file, this is the moment, this is the path. periodt.

---

🫶 SEE ALSO 🫶

go read these next, i'm obsessed with a little cross-referencing moment:

• audit(4)
• audit_class(5)
• audit_control(5)
• audit_user(5)

---

👑 HISTORY 👑

okay storytime 🧚 the OpenBSM implementation was created by McAfee Research, the security division of McAfee Inc., under contract to Apple Computer Inc. in 2004. and then it was subsequently adopted by the TrustedBSD Project as the foundation for the OpenBSM distribution. glow-up arc fr fr 🌈

---

💜 AUTHORS 💜

this software was created by McAfee Research, the security research division of McAfee, Inc., under contract to Apple Computer Inc. additional authors include Wayne Salamon, Robert Watson, and SPARTA Inc. legends, all of them 💅

and the Basic Security Module (BSM) interface to audit records and the audit event stream format were defined by Sun Microsystems. shoutout, iykyk ⭐

---

ngl bestie, that's the whole page — every field, every path, every example, all of it. no details were harmed in the making of this rewrite 💖

---

🌸 so that's AUDIT_EVENT(5) from the File Formats Manual — this particular page is the Debian version, dated January 24, 2004, and that's the tea. bye bestie, go audit something slay ✨🦋🎀