sat_select(1M)

NAME
     sat_select - preselect events for the system audit trail to gather

SYNOPSIS
     sat_select [ -h ] [ idtype ] [ -out ] [ -clearall | -out |
     -on | -off (all | event) ] [ -copy id ]

     sat_select [ filetype ] filename

DESCRIPTION
     sat_select directs the system audit trail to collect records of a
     particular idtype describing certain events and to ignore records
     describing certain other events.  Note that if no idtype is specified,
     then the events will be default to global event mask.  sat_select with no
     arguments lists the audit events currently being collected.

     The effect of multiple executions of sat_select is cumulative.

     The auditable event types are described in the IRIX Admin: Backup,
     Security, and Accounting.  For a brief, online description, see the
     comments in /usr/include/sys/sat.h.

     See audit(1M) or the IRIX Admin: Backup, Security, and Accounting guide
     for more information on configuring the audit subsystem.

     If the audit daemon, satd(1M), isn't running, sat_select does not select
     any audit events for auditing.  This is to prevent inadvertently halting
     the system, which can happen if an audit daemon is not running to remove
     events from the queue.

OPTIONS
     -h           Help is provided.  The names of all possible audit events
                  are displayed.

     idtype       Is one of the followings:
                   -sg|-og gid|name   subject|object group
                   -su|-ou uid|name   subject|object user id
                   -sm|-om mac_label  subject|object mac label
                  No idtype defaults to global event mask.

     -out         Print the names of all active audit events for idtype.  The
                  event names are displayed in the same format that sat_select
                  uses for its command line arguments.

     -on all|event
                  Select the auditing events for a particular idtype. The
                  format of the event string is defined in the
                  sat_eventtostr(3) reference page.  If all is given as the
                  event string, all event types are selected.
     -off all|event
                  Ignore records containing the specified audit event of a
                  certain idtype. The format of the event string is defined in
                  the sat_eventtostr(3) reference page.  If all is given as
                  the event string, all event types are ignored.

     -copy id     Copy the event mask from id to idtype.

     -clearall    Clears all active auditing event masks (global and id
                  specific).

     filetype filename
                  Set events from filename for the filetype:
                   -F  global events
                   -SG subject gid events
                   -SM subject label events
                   -SU subject user events
                   -OG object gid events
                   -OM object label events
                   -OU object user events
                  The file format for all except the global event file will
                  be:
                       <id> [<id>...]: -{-on|-off} event ...
                  The global event file will remain the same with only the
                  events lists. A special event case of all will also be
                  accepted in all files, ie. -F global events

FILES
     /etc/init.d/audit   system audit startup script
     /etc/config/audit   configuration file, on if auditing is enabled
     /etc/config/sat_select.options
                         optional file for site-dependent sat_select options

EXAMPLES
     To collect records describing all System V IPC events (creation, change,
     access, or removal of semaphores, message queues, and shared memory
     segments), in addition to whatever events were previously selected for
     collection, give this command:

               sat_select -on sat_svipc_create -on sat_svipc_change \
               -on sat_svipc_access -on sat_svipc_remove


     To ignore records describing all events, regardless of what may have been
     previously selected, but to collect records initiated by trusted
     administrative programs such as login and su, give this command:

               sat_select -off all -on sat_ae_audit -on sat_ae_identity \
               -on sat_ae_custom
     To save the current audit state in a file that sat_select can read:

               sat_select -out > /etc/config/sat_select.options


     To restore the audit state from a previously saved file:

               sat_select `cat /etc/config/sat_select.options`


     To read the subject user options from the configuration file:

               sat_select -SU guest filename

SEE ALSO
     sat_interpret(1M), sat_reduce(1M), sat_summarize(1M), satd(1M),
     satctl(2), sat_eventtostr(3).

     IRIX Admin: Backup, Security, and Accounting