audfilter(8dce)
A dcecp object that manages the event filters on a DCE host
Synopsis
audfilter catalog
audfilter create audit_filter_name_list -attribute guide_name_list
audfilter delete audit_filter_name_list
audfilter help [operation | -verbose]
audfilter modify audit_filter_name_list [-add guide_name_list] [-remove guide_name_list]
audfilter operations
audfilter show audit_filter_name_list
Arguments
audit_filter_name_list
A list of one or more names of audit event filters. A filter name consists of a filter type and possibly a key depending on the type.
The audit filter types are as follows:
| Type | Key |
| principal | The key is a principal_name. |
| foreign_principal | The key is a /.../cellname/principal_name. |
| group | The key is a group_name. |
| foreign_group | The key is a /.../cellname/group_name. |
| cell | The key is a cellname. |
| cell_overridable | The key is a cellname. |
| world | This type has no key. |
| world_overridable | This type has no key. |
operation
The name of one specific audfilter operation for which to display help information.
Description
The audfilter object represents audit event filters which are kept by the audit daemon to determine if an auditable event should be logged. An audit filter
consists of a list of guides. The name of the audit filter is a filter type and possibly a key (dependent on the type).
This command operates on the audit daemon on the local host, unless the _s(aud) convenience variable is set. If set, the value is taken to be the name of an audit daemon's server entry, as found in the DCE namespace, or as a string binding; and that audit daemon is contacted to service the requests.
More:
Data Structures for audfilter(8dce)