Re: Trusted Facility Audit with User Mask on 10.00
The audit masks are stored in the database as you create them.
When a user makes a connection to the database and audit is enabled, the
server combines the audit masks in the table to create the mask for the
session.
The calculated audit mask is:
(user OR _default) PLUS _require MINUS _exclude
depending on whether the 'user' mask is defined.
onaudit -o shows what you have created - not the result of the calculation.
Note that you can say:
onaudit -a -u user -e +ACTB,ADCK,ADLG,ALIX,ALOP,ALTB,CLDB,CRAM,CRBS,CRDB,...i.e. you dont have to specify one at a time.
Also: using onaudit -f <file>
where contents of <file> is:
<user1> -e +ACTB,ADCK,ADLG
<user2> -e +ACTB,ADCK,ADLG,ALIX
...