Authentication Events
| Appendix D. AIX Audit Events |

## Authentication Events

Event | Class | Parameters | Description
--- | --- | --- | ---
AFS_KAA_ChPswd | S | ECode AFSName HostID name instance | KAA_ChangePassword - Change password.
AFS_KAA_Auth | A S | ECode AFSName HostID name instance | KAA_Authenticate - Authenticate to the cell.
AFS_KAA_AuthO | S | ECode AFSName HostID name instance | KAA_Authenticate_old - Old style authentication.
AFS_KAT_GetTkt | A S | ECode AFSName HostID name instance | KAT_GetTicket - An attempt was made to get an AFS ticket for some principal listed in the Authentication Database.
AFS_KAT_GetTktO | S | ECode AFSName HostID name instance | KAT_GetTicket_old - An attempt was made to get an AFS ticket for some principal listed in the Authentication Database.
AFS_KAM_CrUser | S P | ECode AFSName HostID name instance | KAM_CreateUser - Create a user.
AFS_KAM_DelUser | S P | ECode AFSName HostID name instance | KAM_DeleteUser - Delete a user.
AFS_KAM_SetPswd | S | ECode AFSName HostID name instance | KAM_SetPassword - Set the password for a user.
AFS_KAM_GetPswd | S | ECode AFSName HostID name | KAM_GetPassword - Get the password of a user.
AFS_KAM_GetEnt | S | ECode AFSName HostID name instance | KAM_GetEntry - The RPC made by the kas examine command to get one entry from the Authentication Database (by index entry).
AFS_KAM_LstEnt | S | ECode AFSName HostID index | KAM_ListEntry - The RPC made to list one or more entries in the Authentication Database.
AFS_KAM_Dbg | S | ECode AFSName HostID | KAM_Debug - The RPC that produces a debugging trace for the Authentication Server.
AFS_KAM_SetFld | S P | ECode AFSName HostID name instance flags date lifetime maxAssoc | KAM_SetFields - The RPC used by the kas setfields command to manipulate the Authentication Database.
AFS_KAM_GetStat | S | ECode AFSName HostID | KAM_GetStatus - An RPC used to get statistics on the Authentication Server.
AFS_KAM_GRnKey | S | ECode AFSName HostID | KAM_GetRandomKey - An RPC used to generate a random encryption key.
AFS_UnlockUser | S | ECode AFSName HostID name instance | KAM_Unlock - The RPC used to initiate the kas unlock command.
AFS_LockStatus | None | ECode AFSName HostID name instance | KAM_LockStatus - The RPC used to determine whether a user's Authentication Database entry is locked.
AFS_UseOfPriv | P | ECode AFSName HostID name instance cell | An authorized command was issued and allowed because the user had privilege.
AFS_UnAth | S | ECode AFSName HostID name instance cell | An authorized command was issued and allowed because the system was running in noauth mode.
AFS_UDPAuth | A S | ECode name instance | An authentication attempt was made with a Kerberos client.
AFS_UDPGetTckt | A S | ECode name instance cell name instance | An attempt was made to get a Kerberos ticket.
AFS_RunNoAuth | S | ECode | Check was made and some random server is running noauth.
AFS_NoAuthDsbl | S P | ECode | Server is set to run in authenticated mode.
AFS_NoAuthEnbl | S P | ECode | Server is set to run in unauthenticated mode.

Protection Server Events |  | File Server and Cache Manager Interface Events