HP-UX Reference (11i v2 03/08) - 2 System Calls (vol 5)

audswitch(2) audswitch(2)

NAME

audswitch - suspend or resume auditing on the current process

SYNOPSIS

#include <sys/audit.h>

int audswitch(int aflag);

DESCRIPTION

audswitch() suspends or resumes auditing within the current process. This call is restricted to

superusers.

One of the following aﬂags must be used:

AUD_SUSPEND Suspend auditing on the current process.

AUD_RESUME Resume auditing on the current process.

audswitch() can be used in self-auditing privileged processes to temporarily suspend auditing during

intervals where auditing is to be handled by the process itself. Auditing is suspended by a call to

audswitch() with the AUD_SUSPEND parameter and resumed later by a call to

audswitch() with

the

AUD_RESUME parameter.

audswitch() call to resume auditing serves only to reverse the action of a previous

audswitch() call to suspend auditing. A call to audswitch() to resume auditing when auditing is

not suspended has no effect.

audswitch() affects only the current process. For example, audswitch() cannot suspend auditing

for processes exec’ed from the current process. (Use setaudproc (see setaudproc (2)) to enable or dis-

able auditing for a process and its children).

RETURN VALUE

Upon successful completion,

audswitch() returns 0. If an error occurs, -1 is returned and the global

variable errno is set to indicate the error.

ERRORS

audswitch() fails if one of the following is true:

[EPERM] The user is not a superuser.

[EINVAL] The input parameter is neither AUD_RESUME nor AUD_SUSPEND.

AUTHOR

audswitch() was developed by HP.