saton, satoff, satstate - control the collection of audit data
int saton (int eventtype);
int satoff (int eventtype);
int satstate (int eventtype);
on collection of audit records of the specified event type.
off collection of audit records of the specified event type.
satstate reports whether the audit subsystem is currently collecting or
discarding records of the event type specified.
To modify or query the audit state for every event type, call saton,
satoff, or satstate repeatedly, once for each valid event type.
saton, satoff and satstate fail if one or more of the following
conditions are true:
[ENOPKG] Audit is not configured on this system.
[EPERM] The caller does not have CAP_AUDIT_CONTROL capability.
[EDOM] The specified audit event type is not valid. Valid event
type numbers range from 1 to SAT_NTYPES-1, inclusive.
For satstate, a non-zero (positive) return value indicates that the audit
subsystem is collecting records. A return value of 0 indicates that the
audit subsystem is discarding records. A return value of -1 indicates an
error and errno is set to indicate the error.
For saton and satoff, a return value of -1 indicates an error and errno
is set to indicate the error. Otherwise 0 is returned.
Silicon Graphics, Inc.
PPPPaaaaggggeeee 1111 [ Back ]