Administrator's Guide

Templates and Alerts
Changes to Log File Template
Appendix A
154
NOTE Refer to Table B-1 in Appendix B for the definition of argv[10] through argv[32] that can
be used to access specific alert information (i.e., pid, ppid) without having to parse the
string alert fields above.
Limitations • The template cannot distinguish between whether a file is created or truncated
when creat(2) is invoked.
argv[8] Details String “User with uid <uid> <performed
action on the file> <full
pathname>(type=<type>,inode=<inod
e>, device<device>) when executing
<program>(type=<type>,inode=<inod
e>,device=<device>), invoked as
follows: <argv[0]> <argv[1]>..., as
process with pid <pid> and ppid
<ppid> and running with effective
uid=<euid> and with effective
gid=<egid>.
where <performed action on the file>
is set to one of the following:
"opened for modification/truncation"
"deleted the file"
"deleted the directory"
"performed system call <value> on
the file"
"renamed the file"
"truncated the file"
"created the file (and overwrote any
existing file) named"
Detailed alert
description
argv[9] Local Time Integer <secs> Local time in
number of seconds
since epoch when
file is modified
Table A-12 Append-Only File Being Modified Alert Properties (Continued)
Response
Program
Argument
Alert
Field
Alert Field
Type
Alert Value/Format Description