Auditing individual users and groups

In the Audit Manager, select Collection IDs Modify. Enter the names of users and/or groups. Use the <Tab> to move between the fields.

You also have the choice of causing your selections to take effect during the current session or the next session. You can select different users and groups can be done many times within the same session. If no users and groups are selected, all processes are subject to the system-wide audit mask.

To set the audit mask for an indivdual user (instead of the system-wide mask) use the usermod(ADM) command:

usermod -x "{auditFlags { flags }" user

For example, this command sets the mask for events A-D for user mavrac:

usermod -x "{auditFlags {1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0}}" mavrac

You may find it easier to use a template file instead of typing the flags on the command line. See ``Using account templates''.