user_events

Track user events from the audit framework.

Table schema

Name Type Description
uid BIGINT User ID
auid BIGINT Audit User ID
pid BIGINT Process (or thread) ID
message TEXT Message from the event
type INTEGER The file description for the process socket
path TEXT Supplied path from event
address TEXT The Internet protocol address or family ID
terminal TEXT The network protocol ID
time BIGINT Time of execution in UNIX time
uptime BIGINT Time of execution in system uptime
eid TEXT Event ID