System Administration Guide
Chapter 6, Using the Audit Manager

Collecting audit data

Collecting audit data

These tasks are related to data collection:

Remember that usage of the audit subsystem has two stages, collection and reporting. Each stage involves selection of audit data. Once initiated, the subsystem collects data as directed by the audit masks until auditing is terminated, or the system is halted. The system maintains two types of masks: the system-wide mask that governs default auditing done on all users, and an individual user mask that can be defined for each user. The user mask overrides the system-wide mask.