HP-UX Reference (11i v1 00/12) - 2 System Calls (vol 5)
__________________________________________________________________________________________________________________________________________________________________________________________________
__________________________________________________________________________________________________________________________________________________________________________________________________
STANDARD Printed by: Nora Chuang [nchuang] STANDARD
/build/1111/BRICK/man2/!!!intro.2
________________________________________________________________
___ ___
a
audswitch(2) audswitch(2)
NAME
audswitch - suspend or resume auditing on the current process
SYNOPSIS
#include <sys/audit.h>
int audswitch(int aflag);
DESCRIPTION
audswitch() suspends or resumes auditing within the current process. This call is restricted to
superusers.
One of the following aflags must be used:
AUD_SUSPEND Suspend auditing on the current process.
AUD_RESUME Resume auditing on the current process.
audswitch() can be used in self-auditing privileged processes to temporarily suspend auditing during
intervals where auditing is to be handled by the process itself. Auditing is suspended by a call to
audswitch() with the AUD_SUSPEND parameter and resumed later by a call to
audswitch() with
the
AUD_RESUME parameter.
An audswitch() call to resume auditing serves only to reverse the action of a previous
audswitch() call to suspend auditing. A call to audswitch() to resume auditing when auditing is
not suspended has no effect.
audswitch() affects only the current process. For example, audswitch() cannot suspend auditing
for processes exec’ed from the current process. (Use setaudproc (see setaudproc(2)) to enable or dis-
able auditing for a process and its children).
RETURN VALUE
Upon successful completion,
audswitch() returns 0. If an error occurs, -1 is returned and the global
variable errno is set to indicate the error.
ERRORS
audswitch() fails if one of the following is true:
[EPERM] The user is not a superuser.
[EINVAL] The input parameter is neither AUD_RESUME nor AUD_SUSPEND .
AUTHOR
audswitch() was developed by HP.
SEE ALSO
audit(5), setaudproc(2), audusr(1M), audevent(1M).
Section 2−−24 − 1 − HP-UX Release 11i: December 2000
___
___