*nix Documentation Project
·  Home
 +   man pages
·  Linux HOWTOs
·  FreeBSD Tips
·  *niX Forums

  man pages->HP-UX 11i man pages -> audwrite (2)              


 audwrite(2)                                                     audwrite(2)

 NAME    [Toc]    [Back]
      audwrite - write an audit record for a self-auditing process

 SYNOPSIS    [Toc]    [Back]
      #include <sys/audit.h>

      int audwrite(const struct self_audit_rec *audrec_p);

 DESCRIPTION    [Toc]    [Back]
      audwrite() is called by trusted self-auditing processes, which are
      capable of turning off the regular auditing (using audswitch(2)) and
      doing higher-level auditing on their own.  audwrite() is restricted to

      audwrite() checks to see if the auditing system is on and the calling
      process and the event specified are being audited.  If these
      conditions are met, audwrite() writes the audit record pointed to by
      audrec_p into the audit file.  The record consists of an audit record
      body and a header with the following fields:

           u_long ah_time;          /* Date/time (tv_sec of timeval) */
           pid_t ah_pid;            /* Process ID */
           u_short ah_error;        /* Success/failure */
           u_short ah_event;        /* Event being audited */
           u_short ah_len;          /* Length of variant part */

      The header has the same format as the regular audit record, while the
      body contains additional information about the high-level audit event.
      The header fields ah_error, ah_event, and ah_len are specified by the
      calling process.  audwrite() fills in ah_time and ah_pid fields with
      the correct values.  this is done to reduce the risk of forgery.
      After the header is completed, the record body is attached and the
      entire record is written into the current audit file.

 RETURN VALUE    [Toc]    [Back]
      If the write is successful, a value of 0 is returned.  Otherwise, a
      value of -1 is returned and errno is set to indicate the reason for
      the failure.

 ERRORS    [Toc]    [Back]
      audwrite() fails if one of the following is true:

           EPERM          The caller is not a superuser.

           EINVAL         The event number in the audit record is invalid.

 WARNINGS    [Toc]    [Back]
      If audwrite causes a file space overflow, the calling process might be
      suspended until the file space is cleaned up.  However, a returned
      call with the return value of 0 indicates that the audit record has
      been successfully written.

 Hewlett-Packard Company            - 1 -   HP-UX 11i Version 2: August 2003

 audwrite(2)                                                     audwrite(2)

 AUTHOR    [Toc]    [Back]
      audwrite() was developed by HP.

 SEE ALSO    [Toc]    [Back]
      audswitch(2), audit(4).

 Hewlett-Packard Company            - 2 -   HP-UX 11i Version 2: August 2003
[ Back ]
 Similar pages
Name OS Title
satwrite IRIX write a block of audit record data
audctl HP-UX start or halt the auditing system and set or get audit files
audsys HP-UX start or halt the auditing system and set or display audit file information
setaudproc HP-UX controls process level auditing for the current process and its decendents
sat_write_filehdr IRIX write audit file header, write close time to audit file header
audgenl Tru64 generate an audit record
audgen Tru64 generate an audit record
audgen Tru64 Generates an audit record
satread IRIX read a block of audit record data
sat_read_header_info IRIX Portable interfaces to read audit record headers
Copyright © 2004-2005 DeniX Solutions SRL
newsletter delivery service