Modifying Audit Masks

The DBSSO can modify masks individually from the command line. (If you want to modify several masks at a time, you can create a new input file, change the appropriate masks, and reload them in the mask table.)

You can modify a single mask with the -m option of the onaudit utility. This option lets you use another mask as a base to add or remove individual audit events.

The following example shows how to modify the user mask pat. The _guest template mask forms a base from which a complete set of audit events is drawn. Settings for specific events from that file are then superseded by the events listed as arguments to the -e option.

onaudit -m -u pat -r _guest -e +ALTB,USTB

When you supply a base mask with the -r option, you replace all the audit events in the initial mask. When you change only a few events in a mask, you might not want to specify a base mask. For the syntax and another example of how to modify a mask, see Utility Syntax.