Audit events table

This table contains all events raised by sys.audit() or PySys_Audit() calls throughout the CPython runtime and the standard library. These calls were added in 3.8.0 or later (see PEP 578).

See sys.addaudithook() and PySys_AddAuditHook() for information on handling these events.

CPython implementation detail: This table is generated from the CPython documentation, and may not represent events raised by other implementations. See your runtime specific documentation for actual events raised.

Audit event	Arguments	References
array.__new__	typecode, initializer	[1]
builtins.breakpoint	breakpointhook	[1]
builtins.id	id	[1]
builtins.input	prompt	[1]
builtins.input/result	result	[1]
code.__new__	code, filename, name, argcount, posonlyargcount, kwonlyargcount, nlocals, stacksize, flags	[1]
compile	source, filename	[1]
cpython.PyInterpreterState_Clear		[1]
cpython.PyInterpreterState_New		[1]
cpython._PySys_ClearAuditHooks		[1]
cpython.run_command	command	[1]
cpython.run_file	filename	[1]
cpython.run_interactivehook	hook	[1]
cpython.run_module	module-name	[1]
cpython.run_startup	filename	[1]
cpython.run_stdin		[1]
ctypes.addressof	obj	[1]
ctypes.call_function	func_pointer, arguments	[1]
ctypes.cdata	address	[1]
ctypes.cdata/buffer	pointer, size, offset	[1][2]
ctypes.create_string_buffer	init, size	[1]
ctypes.create_unicode_buffer	init, size	[1]
ctypes.dlopen	name	[1]
ctypes.dlsym	library, name	[1]
ctypes.dlsym/handle	handle, name	[1]
ctypes.get_errno		[1]
ctypes.get_last_error		[1]
ctypes.seh_exception	code	[1]
ctypes.set_errno	errno	[1]
ctypes.set_last_error	error	[1]
ctypes.string_at	address, size	[1]
ctypes.wstring_at	address, size	[1]
ensurepip.bootstrap	root	[1]
exec	code_object	[1][2]
fcntl.fcntl	fd, cmd, arg	[1]
fcntl.flock	fd, operation	[1]
fcntl.ioctl	fd, request, arg	[1]
fcntl.lockf	fd, cmd, len, start, whence	[1]
ftplib.connect	self, host, port	[1]
ftplib.sendcmd	self, cmd	[1][2]
function.__new__	code	[1]
gc.get_objects	generation	[1]
gc.get_referents	objs	[1]
gc.get_referrers	objs	[1]
glob.glob	pathname, recursive	[1][2]
glob.glob/2	pathname, recursive, root_dir, dir_fd	[1][2]
http.client.connect	self, host, port	[1]
http.client.send	self, data	[1]
imaplib.open	self, host, port	[1]
imaplib.send	self, data	[1]
import	module, filename, sys.path, sys.meta_path, sys.path_hooks	[1]
marshal.dumps	value, version	[1]
marshal.load		[1]
marshal.loads	bytes	[1]
mmap.__new__	fileno, length, access, offset	[1]
msvcrt.get_osfhandle	fd	[1]
msvcrt.locking	fd, mode, nbytes	[1]
msvcrt.open_osfhandle	handle, flags	[1]
nntplib.connect	self, host, port	[1][2]
nntplib.putline	self, line	[1][2]
object.__delattr__	obj, name	[1]
object.__getattr__	obj, name	[1]
object.__setattr__	obj, name, value	[1]
open	path, mode, flags	[1][2][3]
os.add_dll_directory	path	[1]
os.chdir	path	[1][2]
os.chflags	path, flags	[1][2]
os.chmod	path, mode, dir_fd	[1][2][3]
os.chown	path, uid, gid, dir_fd	[1][2][3]
os.exec	path, args, env	[1]
os.fork		[1]
os.forkpty		[1]
os.fwalk	top, topdown, onerror, follow_symlinks, dir_fd	[1]
os.getxattr	path, attribute	[1]
os.kill	pid, sig	[1]
os.killpg	pgid, sig	[1]
os.link	src, dst, src_dir_fd, dst_dir_fd	[1]
os.listdir	path	[1]
os.listxattr	path	[1]
os.lockf	fd, cmd, len	[1]
os.mkdir	path, mode, dir_fd	[1][2]
os.posix_spawn	path, argv, env	[1][2]
os.putenv	key, value	[1]
os.remove	path, dir_fd	[1][2][3]
os.removexattr	path, attribute	[1]
os.rename	src, dst, src_dir_fd, dst_dir_fd	[1][2][3]
os.rmdir	path, dir_fd	[1]
os.scandir	path	[1]
os.setxattr	path, attribute, value, flags	[1]
os.spawn	mode, path, args, env	[1]
os.startfile	path, operation	[1]
os.startfile/2	path, operation, arguments, cwd, show_cmd	[1]
os.symlink	src, dst, dir_fd	[1]
os.system	command	[1]
os.truncate	fd, length	[1][2]
os.unsetenv	key	[1]
os.utime	path, times, ns, dir_fd	[1]
os.walk	top, topdown, onerror, followlinks	[1]
pathlib.Path.glob	self, pattern	[1]
pathlib.Path.rglob	self, pattern	[1]
pdb.Pdb		[1]
pickle.find_class	module, name	[1]
poplib.connect	self, host, port	[1][2]
poplib.putline	self, line	[1][2]
pty.spawn	argv	[1]
resource.prlimit	pid, resource, limits	[1]
resource.setrlimit	resource, limits	[1]
setopencodehook		[1]
shutil.chown	path, user, group	[1]
shutil.copyfile	src, dst	[1][2][3]
shutil.copymode	src, dst	[1][2]
shutil.copystat	src, dst	[1][2]
shutil.copytree	src, dst	[1]
shutil.make_archive	base_name, format, root_dir, base_dir	[1]
shutil.move	src, dst	[1]
shutil.rmtree	path, dir_fd	[1]
shutil.unpack_archive	filename, extract_dir, format	[1]
signal.pthread_kill	thread_id, signalnum	[1]
smtplib.connect	self, host, port	[1]
smtplib.send	self, data	[1]
socket.__new__	self, family, type, protocol	[1]
socket.bind	self, address	[1]
socket.connect	self, address	[1][2]
socket.getaddrinfo	host, port, family, type, protocol	[1]
socket.gethostbyaddr	ip_address	[1]
socket.gethostbyname	hostname	[1][2]
socket.gethostname		[1]
socket.getnameinfo	sockaddr	[1]
socket.getservbyname	servicename, protocolname	[1]
socket.getservbyport	port, protocolname	[1]
socket.sendmsg	self, address	[1]
socket.sendto	self, address	[1]
socket.sethostname	name	[1]
sqlite3.connect	database	[1]
sqlite3.connect/handle	connection_handle	[1]
sqlite3.enable_load_extension	connection, enabled	[1]
sqlite3.load_extension	connection, path	[1]
subprocess.Popen	executable, args, cwd, env	[1]
sys._current_exceptions		[1]
sys._current_frames		[1]
sys._getframe	frame	[1]
sys.addaudithook		[1][2]
sys.excepthook	hook, type, value, traceback	[1]
sys.set_asyncgen_hooks_finalizer		[1]
sys.set_asyncgen_hooks_firstiter		[1]
sys.setprofile		[1]
sys.settrace		[1]
sys.unraisablehook	hook, unraisable	[1]
syslog.closelog		[1]
syslog.openlog	ident, logoption, facility	[1]
syslog.setlogmask	maskpri	[1]
syslog.syslog	priority, message	[1]
telnetlib.Telnet.open	self, host, port	[1]
telnetlib.Telnet.write	self, buffer	[1]
tempfile.mkdtemp	fullpath	[1][2]
tempfile.mkstemp	fullpath	[1][2][3]
urllib.Request	fullurl, data, headers, method	[1]
webbrowser.open	url	[1]
winreg.ConnectRegistry	computer_name, key	[1]
winreg.CreateKey	key, sub_key, access	[1][2]
winreg.DeleteKey	key, sub_key, access	[1][2]
winreg.DeleteValue	key, value	[1]
winreg.DisableReflectionKey	key	[1]
winreg.EnableReflectionKey	key	[1]
winreg.EnumKey	key, index	[1]
winreg.EnumValue	key, index	[1]
winreg.ExpandEnvironmentStrings	str	[1]
winreg.LoadKey	key, sub_key, file_name	[1]
winreg.OpenKey	key, sub_key, access	[1]
winreg.OpenKey/result	key	[1][2][3]
winreg.PyHKEY.Detach	key	[1]
winreg.QueryInfoKey	key	[1]
winreg.QueryReflectionKey	key	[1]
winreg.QueryValue	key, sub_key, value_name	[1][2]
winreg.SaveKey	key, file_name	[1]
winreg.SetValue	key, sub_key, type, value	[1][2]

The following events are raised internally and do not correspond to any public API of CPython:

Audit event	Arguments
_winapi.CreateFile	file_name, desired_access, share_mode, creation_disposition, flags_and_attributes
_winapi.CreateJunction	src_path, dst_path
_winapi.CreateNamedPipe	name, open_mode, pipe_mode
_winapi.CreatePipe
_winapi.CreateProcess	application_name, command_line, current_directory
_winapi.OpenProcess	process_id, desired_access
_winapi.TerminateProcess	handle, exit_code
ctypes.PyObj_FromPtr	obj