Audit-Specific Events
| Appendix D. AIX Audit Events |

## Audit-Specific Events

Event | Class | Parameters | Description
--- | --- | --- | ---
AFS_Audit_WR | None | <string> | The file "/usr/afs/Audit" has been written to (AIX specific event).
AFS_Aud_On | S | ECode | Auditing is on for this server process (recorded on startup of a server).
AFS_Aud_Off | S | ECode | Auditing is off for this server process (recorded on startup of a server).
AFS_Aud_Unauth | S | ECode Event | Event triggered by an unauthorized user.

### Note

The following audit-specific events indicate an error has occurred while recording the event. Most events have an AFSName associated with them and a host ID. If this information cannot be gathered out of the Rx structure, one of these events is raised.

Event | Class | Parameters | Description
--- | --- | --- | ---
AFS_Aud_NoCall | S | ECode Event | No rx call structure with this event. Cannot get security, AFS ID, or origin of call.
AFS_Aud_NoConn | S | ECode Event | No connection info associated with rx call. Cannot get security, AFS ID, or origin of call.
AFS_Aud_UnknSec | S | ECode Event | Security of call is unknown (must be authorized or unauthorized caller).
AFS_Aud_NoAFSId | S | ECode Event | No AFS ID/name associated with a secure event.
AFS_Aud_NoHost | S | ECode Event | No information about origin (machine) of caller.
AFS_Aud_EINVAL | None | Event | Error in audit event parameter (can't record the event parameter).

Appendix D. AIX Audit Events |  | Volume Server Events