Use the event.execution.monitor.user.skiplist parameter to specify a list of users to exclude from advanced monitoring for program execution. For these users, the auditing service does not record any programs that they run, even when the parameter event.execution.monitor is set to true.
For users specified in this list, the auditing service checks for the user account that the program is run by, also known as the “run as” user account.
To use this parameter, you must have enabled the agent to perform advanced monitoring with the command dacontrol -m.
Doc Feedback