HP-UX Reference (11i v1 05/09) - 2 System Calls (vol 5)

audctl(2) audctl(2)

AUD_OFF The caller issues the AUD_OFF command to halt the auditing system. If the

auditing system is on, it is turned off and the "current" and "next" audit ﬁles are

closed. cpath, npath, and mode are ignored. If the audit system is already off,

-1 is returned and errno is set to [EALREADY].

RETURN VALUE

Upon successful completion, a value of 0

is returned. Otherwise, -1 is returned and the global variable

errno is set to indicate the error.

EXAMPLES

In the following example, audctl() is used to determine whether the auditing system is on, and to

retrieve the names of the audit ﬁles that are currently in use by the system.

char c_file[PATH_MAX+1], x_file[PATH_MAX+1];

int mode=0600;

if (audctl(AUD_GET, c_file, x_file, mode))

switch ( errno ) {

case

ENOENT:

strcpy(x_file,"-none-");

break;

case

EALREADY:

printf("The auditing system is

OFF\n");

return 0;

case default:

fprintf(stderr, "Audctl failed: errno=%d\n", errno);

return 1;

}

printf("The auditing system is ON: c_file=%s x_file=%s\n",

c_file, x_file);

return 0;

ERRORS

audctl() fails if one of the following is true:

[EPERM] The caller does not have superuser privilege, or one or both of the given ﬁles are

not regular ﬁles and cannot be used.

[EALREADY] The AUD_OFF, AUD_SET, AUD_SETCURR , AUD_SETNEXT , AUD_SWITCH,

or AUD_GET cmd was speciﬁed while the auditing system is off.

[EBUSY] User attempt to start the auditing system failed because auditing is already on.

[EFAULT] Bad pointer. One or more of the required function parameters is not accessible.

[EINVAL] The cpath or npath is greater than PATH_MAX in length, the cpath or npath

speciﬁed is not an absolute path name.

[ENOENT] No available "next" ﬁle when cmd is

AUD_GETNEXT or AUD_SWITCH .

AUTHOR

audctl() was developed by HP.