HP-UX Reference (11i v3 07/02) - 2 System Calls (vol 5)

a
audctl(2) audctl(2)
(TO BE OBSOLETED)
ignored. The auditing system begins writing to the new "current" file. If the auditing
system is off, no action is performed;
-1 is returned, and errno is set to EAL-
READY
. If the auditing system is on and there is no available "next" file, no action is
performed; -1 is returned, and errno is set to [ENOENT].
AUD_OFF The caller issues the AUD_OFF command to halt the auditing system. If the auditing
system is on, it is turned off and the "current" and "next" audit files are closed. cpath,
npath, and mode are ignored. If the audit system is already off,
-1 is returned and
errno is set to [EALREADY].
Security Restrictions
Some or all of the actions associated with this system call require the
AUDCONTROL privilege. Processes
owned by the superuser have this privilege. Processes owned by other users may have this privilege,
depending on system configuration. See privileges (5) for more information about privileged access on sys-
tems that support fine-grained privileges.
RETURN VALUE
Upon successful completion, a value of
0
is returned. Otherwise, -1 is returned and the global variable
errno is set to indicate the error.
EXAMPLES
In the following example, audctl() is used to determine whether the auditing system is on, and to
retrieve the names of the audit files that are currently in use by the system.
char c_file[PATH_MAX+1], x_file[PATH_MAX+1];
int mode=0600;
if (audctl(AUD_GET, c_file, x_file, mode))
switch ( errno ) {
case ENOENT:
strcpy(x_file,"-none-");
break;
case EALREADY:
printf("The auditing system is OFF\n");
return 0;
case default:
fprintf(stderr, "Audctl failed: errno=%d\n", errno);
return 1;
}
printf("The auditing system is ON: c_file=%s x_file=%s\n",
c_file, x_file);
return 0;
ERRORS
audctl() fails if one of the following is true:
[EPERM] The caller does not have the AUDCONTROL privilege, or one or both of the given files
are not regular files and cannot be used.
[EALREADY] The AUD_OFF, AUD_SET, AUD_SETCURR , AUD_SETNEXT , AUD_SWITCH ,or
AUD_GET cmd was specified while the auditing system is off.
[EBUSY] User attempt to start the auditing system failed because auditing is already on.
[EFAULT] Bad pointer. One or more of the required function parameters is not accessible.
[EINVAL] The cpath or npath is greater than PATH_MAX in length, the cpath or npath specified
is not an absolute path name.
[ENOENT] No available "next" file when cmd is AUD_GET or AUD_SWITCH .
AUTHOR
audctl() was developed by HP.
HP-UX 11i Version 3: February 2007 − 2 − Hewlett-Packard Company 55