Defining Event Classes
Individual audit events can be grouped together to form event classes. The event class provides an efficient mechanism by which sets of events can be logically grouped and selected using a single value.
DCE audit event classes are configurable. You can add or remove events of an existing event class or define new event classes.
The ability to define local event classes is useful in simplifying the management of audit services in multiple DCE applications. Administrators can design their own audit event classes reflecting their security requirements and trail storage resource constraints.
Temporary event classes can also be created to track down security violations.
More:
Steps in Defining an Event Class