python_doc_md/Intermediate/library/audit_events.md

:::: {#audit-events} ::: index single: audit events ::: ::::

Audit events table

This table contains all events raised by sys.audit{.interpreted-text role="func"} or PySys_Audit{.interpreted-text role="c:func"} calls throughout the CPython runtime and the standard library. These calls were added in 3.8 or later (see 578{.interpreted-text role="pep"}).

See sys.addaudithook{.interpreted-text role="func"} and PySys_AddAuditHook{.interpreted-text role="c:func"} for information on handling these events.

::: impl-detail This table is generated from the CPython documentation, and may not represent events raised by other implementations. See your runtime specific documentation for actual events raised. :::

::: audit-event-table :::

The following events are raised internally and do not correspond to any public API of CPython:

---

Audit event Arguments

---

[winapi.CreateFile]{#winapi.createfile} file_name, desired_access, share_mode, creation_disposition, flags_and_attributes

[winapi.CreateJunction]{#winapi.createjunction} src_path, dst_path

[winapi.CreateNamedPipe]{#winapi.createnamedpipe} name, open_mode, pipe_mode

[winapi.CreatePipe]{#winapi.createpipe}

[winapi.CreateProcess]{#winapi.createprocess} application_name, command_line, current_directory

[winapi.OpenProcess]{#winapi.openprocess} process_id, desired_access

[winapi.TerminateProcess]{#winapi.terminateprocess} handle, exit_code

[posixsubprocess.fork_exec]{#posixsubprocess.fork_exec} exec_list, args, env

ctypes.PyObj_FromPtr obj

::: versionadded 3.14 The _posixsubprocess.fork_exec internal audit event. :::