VMS Help ANALYZE, /AUDIT, /SELECT, SUBTYPE  *Conan The Librarian (sorry for the slow response - running on an old VAX)

    SUBTYPE=(subtype,...)

    Specifies that the criteria be limited to the value or values
    specified as a subtype. The following table lists events and
    their related subtypes. After SUBTYPE, enter the subtypes as they
    appear in the list; for example, SUBTYPE=ALARM_STATE. (In other
    words, do not enter a prefix.)

    Symbols for Event Types
    and Subtypes              Meaning

    NSA$C_MSG_AUDIT           Systemwide change to auditing
          ALARM_STATE         Events enabled as alarms
          AUDIT_DISABLED      Audit events disabled
          AUDIT_ENABLED       Audit events enabled
          AUDIT_INITIATE      Audit server startup
          AUDIT_LOG_FIRST     First entry in audit log (backward link)
          AUDIT_LOG_FINAL     Final entry in audit log (forward link)
          AUDIT_STATE         Events enabled as audits
          AUDIT_TERMINATE     Audit server shutdown

    NSA$C_MSG_BREAKIN         Break-in attempt detected
          BATCH               Batch process
          DETACHED            Detached process
          DIALUP              Dialup interactive process
          LOCAL               Local interactive process
          NETWORK             Network server task
          REMOTE              Interactive process from another network
                              node
          SUBPROCESS          Subprocess

    NSA$C_MSG_CONNECTION      Logical link connection or termination
          CNX_ABORT           Connection aborted
          CNX_ACCEPT          Connection accepted
          CNX_DECNET_CREATE   DECnet logical link created
          CNX_DECNET_DELETE   DECnet logical link disconnected
          CNX_DISCONNECT      Connection disconnected
          CNX_INC_ABORT       Incoming connection request aborted
          CNX_INC_ACCEPT      Incoming connection request accepted
          CNX_INC_DISCONNECT  Incoming connection disconnected
          CNX_INC_REJECT      Incoming connection request rejected
          CNX_INC_REQUEST     Incoming connection request
          CNX_IPC_CLOSE       Interprocess communication association
                              closed
          CNX_IPC_OPEN        Interprocess communication association
                              opened
          CNX_REJECT          Connection rejected
          CNX_REQUEST         Connection requested

    NSA$C_MSG_INSTALL         Use of the Install utility (INSTALL)
          INSTALL_ADD         Known image installed
          INSTALL_REMOVE      Known image deleted

    NSA$C_MSG_LOGFAIL         Login failure
          See subtypes for NSA$C_MSG_BREAKIN

    NSA$C_MSG_LOGIN           Successful login
          See subtypes for NSA$C_MSG_BREAKIN

    NSA$C_MSG_LOGOUT          Successful logout
          See subtypes for NSA$C_MSG_BREAKIN

    NSA$C_MSG_MOUNT           Volume mount or dismount
          VOL_DISMOUNT        Volume dismount
          VOL_MOUNT           Volume mount

    NSA$C_MSG_NCP             Modification to network configuration
                              database
          NCP_COMMAND         Network Control Program (NCP) command
                              issued

    NSA$C_MSG_NETPROXY        Modification to network proxy database
          NETPROXY_ADD        Record added to network proxy
                              authorization file
          NETPROXY_DELETE     Record removed from network proxy
                              authorization file
          NETPROXY_MODIFY     Record modified in network proxy
                              authorization file

    NSA$C_MSG_OBJ_ACCESS      Object access attempted
          OBJ_ACCESS          Access attempted to create, delete, or
                              deaccess an object

    NSA$C_MSG_OBJ_CREATE      Object creation attempted
          OBJ_CREATE          Access attempted to create an object

    NSA$C_MSG_OBJ_DEACCESS    Object deaccessed
          OBJ_DEACCESS        Attempt to complete access to an object

    NSA$C_MSG_OBJ_DELETE      Object deletion attempted
          OBJ_DELETE          Object deletion attempted

    NSA$C_MSG_PROCESS         Process controlled through a system service
          PRC_CANWAK          Process wakeup canceled
          PRC_CREPRC          Process created
          PRC_DELPRC          Process deleted
          PRC_FORCEX          Process exit forced
          PRC_GETJPI          Process information gathered
          PRC_GRANTID         Process identifier granted
          PRC_RESUME          Process resumed
          PRC_REVOKID         Process identifier revoked
          PRC_SCHDWK          Process wakeup scheduled
          PRC_SETPRI          Process priority altered
          PRC_SIGPRC          Process exception issued
          PRC_SUSPND          Process suspended
          PRC_TERM            Process termination notification requested
          PRC_WAKE            Process wakeup issued

    NSA$C_MSG_PRVAUD          Use of privilege
          PRVAUD_FAILURE      Unsuccessful use of privilege
          PRVAUD_SUCCESS      Successful use of privilege

    NSA$C_MSG_RIGHTSDB        Modification to the rights database
          RDB_ADD_ID          Identifier added to rights database
          RDB_CREATE          Rights database created
          RDB_GRANT_ID        Identifier granted to user
          RDB_MOD_HOLDER      List of identifier holders modified
          RDB_MOD_ID          Identifier name or attributes modified
          RDB_REM_ID          Identifier removed from rights database
          RDB_REVOKE_ID       Identifier taken away from user

    NSA$C_MSG_SYSGEN          Use of the System Generation utility
                              (SYSGEN)
          SYSGEN_SET          System parameter modified

    NSA$C_MSG_SYSTIME         Modification to system time
          SYSTIM_SET          System time set
          SYSTIM_CAL          System time calibrated

    NSA$C_MSG_SYSUAF          Modification to system user
                              authorization file (SYSUAF)
          SYSUAF_ADD          Record added to system user
                              authorization file
          SYSUAF_COPY         Record added to system user
                              authorization file
          SYSUAF_DELETE       Record deleted from system user
                              authorization file
          SYSUAF_MODIFY       Record modified in system user
                              authorization file
          SYSUAF_RENAME       Record renamed in system user
                              authorization file