audfilter modify
Adds or removes one or more guides of a filter. The syntax is:
audfilter modify audit_filter_name_list
{[-add guide_name_list] [-remove guide_name_list]}
Options
-add guide_name_list
Specifies a list of one or more guides to be added to the specified audit event filters that are to be modified. A guide name consists of three
elements: an audit condition, an audit action, and an event class.
See the Data Structures topic of this reference page for information
about guide names.
-remove guide_name_list
Specifies a list of one or more guides to be removed from the specified audit event filters that are to be modified. A guide name consists of
three elements: an audit condition, an audit action, and an event class.
See the Data Structures topic of this reference page for
information about guide names.
Description
The audfilter modify operation adds or removes one or more guides of a filter. The argument is a list of names of audit filters to be modified. In
addition, the specific operation to perform is described with one or more of the following options: -add and -remove. The argument to both of these options is a list of guides. If
more than one guide is specified, all guides are operated on, but not atomically. If the last guide is removed from a filter, the filter is deleted at some point by the audit daemon.
Atomicity of multiple actions is not guaranteed.
Similarly, the effect of adding a guide which partially exists in the specified filter is to change the existing guide(s). These changes guarantee that the semantics of the removal/addition is maintained. The operation returns an empty string on success.
Privileges Required
You must have w (write) permission on the audit daemon's ACL and be authenticated.
Examples
dcecp> audfilter modify {principal rousseau}\
-add {dce_dts_mgt_modify failure alarm} \
-remove {dce_dts_mgt_query all log}
dcecp>