Audit events table

This table contains all events raised by sys.audit() or PySys_Audit() calls throughout the CPython runtime and the standard library. These calls were added in 3.8.0 or later.

See sys.addaudithook() and PySys_AddAuditHook() for information on handling these events.

CPython implementation detail: This table is generated from the CPython documentation, and may not represent events raised by other implementations. See your runtime specific documentation for actual events raised.

Audit event	Arguments	References
array.__new__	typecode, initializer	[1]
builtins.breakpoint	breakpointhook	[1]
builtins.input	prompt	[1]
builtins.input/result	result	[1]
code.__new__	code, filename, name, argcount, posonlyargcount, kwonlyargcount, nlocals, stacksize, flags	[1]
compile	source, filename	[1]
cpython.PyInterpreterState_Clear		[1]
cpython.PyInterpreterState_New		[1]
cpython._PySys_ClearAuditHooks		[1]
cpython.run_command	command	[1]
cpython.run_file	filename	[1]
cpython.run_interactivehook	hook	[1]
cpython.run_module	module-name	[1]
cpython.run_startup	filename	[1]
cpython.run_stdin		[1]
ctypes.addressof	obj	[1]
ctypes.call_function	func_pointer, arguments	[1]
ctypes.cdata	address	[1]
ctypes.cdata/buffer	pointer, size, offset	[1][2]
ctypes.create_string_buffer	init, size	[1]
ctypes.create_unicode_buffer	init, size	[1]
ctypes.dlopen	name	[1]
ctypes.dlsym	library, name	[1]
ctypes.dlsym/handle	handle, name	[1]
ctypes.get_errno		[1]
ctypes.get_last_error		[1]
ctypes.seh_exception	code	[1]
ctypes.set_errno	errno	[1]
ctypes.set_last_error	error	[1]
ctypes.string_at	address, size	[1]
ctypes.wstring_at	address, size	[1]
ensurepip.bootstrap	root	[1]
exec	code_object	[1][2]
ftplib.connect	self, host, port	[1]
ftplib.sendcmd	self, cmd	[1][2]
glob.glob	pathname, recursive	[1][2]
imaplib.open	self, host, port	[1]
imaplib.send	self, data	[1]
import	module, filename, sys.path, sys.meta_path, sys.path_hooks	[1]
mmap.__new__	fileno, length, access, offset	[1]
nntplib.connect	self, host, port	[1][2]
nntplib.putline	self, line	[1][2]
open	file, mode, flags	[1][2][3]
os.listdir	path	[1]
os.scandir	path	[1]
os.system	command	[1]
os.truncate	fd, length	[1][2]
pdb.Pdb		[1]
pickle.find_class	module, name	[1]
poplib.connect	self, host, port	[1][2]
poplib.putline	self, line	[1][2]
shutil.copytree	src, dst	[1]
shutil.make_archive	base_name, format, root_dir, base_dir	[1]
shutil.rmtree	path	[1]
smtplib.connect	self, host, port	[1]
smtplib.send	self, data	[1]
socket.__new__	self, family, type, protocol	[1]
socket.bind	self, address	[1]
socket.connect	self, address	[1][2]
socket.getaddrinfo	host, port, family, type, protocol	[1]
socket.gethostbyaddr	ip_address	[1]
socket.gethostbyname	hostname	[1][2]
socket.gethostname		[1]
socket.getnameinfo	sockaddr	[1]
socket.getservbyname	servicename, protocolname	[1]
socket.getservbyport	port, protocolname	[1]
socket.sendmsg	self, address	[1]
socket.sendto	self, address	[1]
socket.sethostname	name	[1]
sqlite3.connect	database	[1]
subprocess.Popen	executable, args, cwd, env	[1]
sys._current_frames		[1]
sys._getframe		[1]
sys.addaudithook		[1][2]
sys.excepthook	hook, type, value, traceback	[1]
sys.set_asyncgen_hooks_finalizer		[1]
sys.set_asyncgen_hooks_firstiter		[1]
sys.setprofile		[1]
sys.settrace		[1]
sys.unraisablehook	hook, unraisable	[1]
telnetlib.Telnet.open	self, host, port	[1]
telnetlib.Telnet.write	self, buffer	[1]
tempfile.mkdtemp	fullpath	[1][2]
tempfile.mkstemp	fullpath	[1][2][3]
urllib.Request	fullurl, data, headers, method	[1]
webbrowser.open	url	[1]
winreg.ConnectRegistry	computer_name, key	[1]
winreg.CreateKey	key, sub_key, access	[1][2]
winreg.DeleteKey	key, sub_key, access	[1][2]
winreg.DeleteValue	key, value	[1]
winreg.DisableReflectionKey	key	[1]
winreg.EnableReflectionKey	key	[1]
winreg.EnumKey	key, index	[1]
winreg.EnumValue	key, index	[1]
winreg.ExpandEnvironmentStrings	str	[1]
winreg.LoadKey	key, sub_key, file_name	[1]
winreg.OpenKey	key, sub_key, access	[1]
winreg.OpenKey/result	key	[1][2][3]
winreg.PyHKEY.Detach	key	[1]
winreg.QueryInfoKey	key	[1]
winreg.QueryReflectionKey	key	[1]
winreg.QueryValue	key, sub_key, value_name	[1][2]
winreg.SaveKey	key, file_name	[1]
winreg.SetValue	key, sub_key, type, value	[1][2]