Security events are related to the following actions or activities:
Attempted login or log off, whether successful or not
Establishment of a new administrative access session regardless of port of entry
Assignment of a user profile to an administrative session
Display, list, change, add or delete of a user profile
Any administrative access to local user accounts (view, add, change, delete)
Failed attempt to access an object or execute an action to which the user does not have access
Any access to the security control configuration of the server: logging configuration, the PAM configuration, or the firewall configuration.
Note You cannot disable logging of security events.
The table shows the syslog priority and facility for security and non-security events.