Event Class Files
Event classes are defined in event class files. All event class files must be created in the dcelocal/etc/audit/ec directory.
Default event class files are provided to classify auditable events from the DCE Security Service, Time Service, and Audit Service. They are installed on the host system when any of these services is installed.
The name of an event class is the same as its filename. Each event class is defined within an event class file.
You can define new event classes by removing or adding event numbers in the event class files, or by creating new event class files.