Creating a user mask from a template mask
A mask that is used as the foundation for one or more other masks is a base mask.
To create a user mask from a template mask:
Create the template mask. After you create a template mask
for a given user category, you can use it as the basis of masks for
individual users, adding or removing only the audit events that differ
for each user.
The following example creates a user
mask for the user terry, based on the _guest template
mask:
onaudit -a -u terry -r _guest -e -CRDBThe terry mask has the same audit events as the _guest mask, except for the CRDB (Create Database) audit event, which was removed.
Instead of template masks, you can also use existing user _default, _require, and _exclude masks as base masks.
Tip: If you use a template or user mask as a base mask for another
mask, the new mask inherits the events in the base mask. The new mask
does not refer to the base mask dynamically. Future changes to the
base mask are not reflected in other masks that might have been created
or modified with that mask as a base.