audit_dpms_filter.4 (2010 09)

a
audit_dpms_filter(4) audit_dpms_filter(4)
The next example selects the root user’s activities in session 1234.
[filter]
+event=exec;
+login_user=root;
+command=sh;
+sid=1234;
More sample DPMS filters can be found under
/etc/audit/dpms_filters
.
SEE ALSO
auditdp(1M), audit_dpms_api(3), audit.conf(4).
6 Hewlett-Packard Company − 6 − HP-UX 11i Version 3: September 2010