Modifying audit masks

About this task

The DBSSO can modify masks individually from the command line.

To modify audit masks:


Use the -m option of the onaudit utility to modify a single mask. You can use this option to use another mask as a base to add or remove individual audit events.
To modify several masks at a time, you can create a new input file, change the appropriate masks, and reload them in the mask table.
The following example shows how to modify the user mask pat. The _guest template mask forms a base from which a complete set of audit events is drawn. Settings for specific events from that file are then superseded by the events listed as arguments to the -e option.
onaudit -m -u pat -r _guest -e +ALTB,USTB

When you supply a base mask with the -r option, you replace all the audit events in the initial mask. When you change only a few events in a mask, you might not want to specify a base mask. For the syntax and another example of how to modify a mask, see The onaudit utility: Configure audit masks.