Creating and Maintaining Filters
After starting the audit daemon and creating the event class file, you can run dcecp to create, modify, or display the filters maintained by the audit daemon. Use the audfilter create, audfilter modify, and audfilter delete commands to create, modify, and delete the filters. Use the audfilter catalog and audfilter show commands to display the existing filters.
More: