|
|
|
#include <bsm/audit.h> #include <bsm/audit_record.h>
The functionality described in this man page is available only if the Basic Security Module (BSM) has been enabled. See bsmconv.1m for more information.
audit.log files are the depository for audit records stored locally or on an audit server. These files are kept in directories named in the file audit_control.4 They are named to reflect the time they are created and are, when possible, renamed to reflect the time they are closed as well. The name takes the form
yyyymmddhhmmss.not_terminated.hostname
when open or if the auditd.1m terminated ungracefully, and the form
yyyymmddhhmmss.yyyymmddhhmmss.hostname
when properly closed. yyyy is the year, mm the month, dd day in the month, hh hour in the day, mm minute in the hour, and ss second in the minute. All fields are of fixed width.
The audit.log file begins with a standalone file token and typically ends with one also. The beginning file token records the pathname of the previous audit file, while the ending file token records the pathname of the next audit file. If the file name is NULL the appropriate path was unavailable.
The audit.log files contains audit records. Each audit record is made up of audit tokens. Each record contains a header token followed by various data tokens. Depending on the audit policy in place by auditon.2 optional other tokens such as trailers or sequences may be included.
The tokens are defined as follows:
The file token consists of:
token ID char seconds of time u_int milliseconds of time u_int file name length short file pathname null terminated string
The header token consists of:
token ID char record byte count u_long version # char (1) event type u_short event modifier u_short seconds of time u_int milliseconds of time u_int
The trailer token consists of:
token ID char trailer magic number u_short record byte count u_long
The arbitrary data token is defined:
token ID char how to print char basic unit char unit count char data items depends on basic unit
The in_addr token consists of:
token ID char internet address long
The ip token consists of:
token ID char version and ihl char type of service char length short id u_short offset u_short ttl char protocol char checksum u_short source address long destination address long
The iport token consists of:
token ID char port address short
The opaque token consists of:
token ID char size short data char, size chars
The
path
token consists of:
token ID char path length short path null terminated string
The process token consists of:
token ID char auid u_long euid u_long egid u_long ruid u_long rgid u_long pid u_long sid u_long terminal ID u_long (port ID) u_long (machine ID)
The return token consists of:
token ID char error number char return value u_int
The subject token consists of:
token ID char auid u_long euid u_long egid u_long ruid u_long rgid u_long pid u_long sid u_long terminal ID u_long (port ID) u_long (machine ID)
The System V IPC token consists of:
token ID char object ID type char object ID long
The text token consists of:
token ID char text length short text null terminated string
The attribute token consists of:
token ID char mode u_long uid u_long gid u_long file system id long node id long device u_long
The groups token consists of:
token ID char number short group list long, size chars
The System V IPC permission token consists of:
token ID char uid u_long gid u_long cuid u_long cgid u_long mode u_long seq u_long key long
The arg token consists of:
token ID char argument # char argument value long string length short text null terminated string
The exec_args token consists of:
token ID char count short text count null terminated string(s)
The exec_env token consists of:
token ID char count short text count null terminated string(s)
The exit token consists of:
token ID char status long return value long
The socket token consists of:
token ID char socket type short local port short local Internet address long remote port short remote Internet address long
The seq token consists of:
token ID char sequence number long
Each token is generally written using the au_to.3 family of function calls.
|
|
|
Created by unroff & hp-tools. © by Hans-Peter Bischof. All Rights Reserved (1997).
Last modified 21/April/97