HP-UX Reference (11i v1 00/12) - 2 System Calls (vol 5)

ManualsBrandsHP ManualsSoftwareHP-UX Reference Manuals

__________________________________________________________________________________________________________________________________________________________________________________________________

STANDARD Printed by: Nora Chuang [nchuang] STANDARD

/build/1111/BRICK/man2/!!!intro.2

________________________________________________________________

___ ___

audctl(2) audctl(2)

NAME

audctl - start or halt the auditing system and set or get audit ﬁles

SYNOPSIS

#include <sys/audit.h>

int audctl(int cmd, char *cpath, char *npath, mode_t mode);

DESCRIPTION

audctl() sets or gets the auditing system "current" and "next" audit ﬁles, and starts or halts the audit-

ing system. This call is restricted to superusers. cpath and npath hold the absolute path names of the

"current" and "next" ﬁles. mode speciﬁes the audit ﬁle’s permission bits. cmd is one of the following

speciﬁcations:

AUD_ON The caller issues the AUD_ON command with the required "current" and "next"

ﬁles to turn on the auditing system. If the auditing system is currently off, it is

turned on; the ﬁle speciﬁed by the cpath parameter is used as the "current" audit

ﬁle, and the ﬁle speciﬁed by the npath parameter is used as the "next" audit ﬁle.

If the audit ﬁles do not already exist, they are created with the mode speciﬁed.

The auditing system then begins writing to the speciﬁed "current" ﬁle. An empty

string or

NULL npath can be speciﬁed if the caller wants to designate that no

"next" ﬁle be available to the auditing system. If the auditing system is already

on, no action is performed; -1 is returned and errno is set to EBUSY.

AUD_GET The caller issues the AUD_GET command to retrieve the names of the "current"

and "next" audit ﬁles. If the auditing system is on, the names of the "current"

and "next" audit ﬁles are returned via the cpath and npath parameters (which

must point to character buffers of sufﬁcient size to hold the ﬁle names). mode is

ignored. If the auditing system is on and there is no available "next" ﬁle, the

"current" audit ﬁle name is returned via the cpath parameter, npath is set to an

empty string;

-1 is returned, and errno is set to ENOENT. If the auditing sys-

tem is off, no action is performed;

-1 is returned and errno is set to EAL-

READY.

AUD_SET The caller issues the AUD_SET command to change both the "current" and

"next" ﬁles. If the audit system is on, the ﬁle speciﬁed by cpath is used as the

"current" audit ﬁle, and the ﬁle speciﬁed by npath is used as the "next" audit ﬁle.

If the audit ﬁles do not already exist, they are created with the speciﬁed mode.

The auditing system begins writing to the speciﬁed "current" ﬁle. Either an

empty string or

NULL npath can be speciﬁed if the caller wants to designate that

no "next" ﬁle be available to the auditing system. If the auditing system is off,

no action is performed; -1 is returned and errno is set to EALREADY.

AUD_SETCURR The caller issues the AUD_SETCURR command to change only the "current"

audit ﬁle. If the audit system is on, the ﬁle speciﬁed by cpath is used as the

"current" audit ﬁle. If the speciﬁed "current" audit ﬁle does not exist, it is

created with the speciﬁed mode. npath is ignored. The auditing system begins

writing to the speciﬁed "current" ﬁle. If the audit system is off, no action is per-

formed; -1 is returned and errno is set to EALREADY.

AUD_SETNEXT The caller issues the AUD_SETNEXT command to change only the "next" audit

ﬁle. If the auditing system is on, the ﬁle speciﬁed by npath is used as the "next"

audit ﬁle. cpath is ignored. If the "next" audit ﬁle speciﬁed does not exist, it is

created with the speciﬁed mode. Either an empty string or

NULL npath can be

speciﬁed if the caller wants to designate that no "next" ﬁle be available to the

auditing system. If the auditing system is off, no action is performed;

-1 is

returned, and errno is set to EALREADY.

AUD_SWITCH The caller issues the AUD_SWITCH command to cause auditing system to

switch audit ﬁles. If the auditing system is on, it uses the "next" ﬁle as the new

"current" audit ﬁle and sets the new "next" audit ﬁle to NULL. cpath, npath,and

mode are ignored. The auditing system begins writing to the new "current" ﬁle.

If the auditing system is off, no action is performed;

-1 is returned, and

errno is set to EALREADY. If the auditing system is on and there is no avail-

able "next" ﬁle, no action is performed; -1 is returned, and

errno is set to

ENOENT.

Section 2−−22 − 1 − HP-UX Release 11i: December 2000

___