audswitch(2) audswitch(2)
NAME [Toc] [Back]
audswitch - suspend or resume auditing on the current process
SYNOPSIS [Toc] [Back]
#include <sys/audit.h>
int audswitch(int aflag);
DESCRIPTION [Toc] [Back]
audswitch() suspends or resumes auditing within the current process.
This call is restricted to superusers.
One of the following aflags must be used:
AUD_SUSPEND Suspend auditing on the current process.
AUD_RESUME Resume auditing on the current process.
audswitch() can be used in self-auditing privileged processes to
temporarily suspend auditing during intervals where auditing is to be
handled by the process itself. Auditing is suspended by a call to
audswitch() with the AUD_SUSPEND parameter and resumed later by a call
to audswitch() with the AUD_RESUME parameter.
An audswitch() call to resume auditing serves only to reverse the
action of a previous audswitch() call to suspend auditing. A call to
audswitch() to resume auditing when auditing is not suspended has no
effect.
audswitch() affects only the current process. For example,
audswitch() cannot suspend auditing for processes exec'ed from the
current process. (Use setaudproc (see setaudproc(2)) to enable or
disable auditing for a process and its children).
RETURN VALUE [Toc] [Back]
Upon successful completion, audswitch() returns 0. If an error
occurs, -1 is returned and the global variable errno is set to
indicate the error.
ERRORS [Toc] [Back]
audswitch() fails if one of the following is true:
[EPERM] The user is not a superuser.
[EINVAL] The input parameter is neither AUD_RESUME nor
AUD_SUSPEND.
AUTHOR [Toc] [Back]
audswitch() was developed by HP.
Hewlett-Packard Company - 1 - HP-UX 11i Version 2: August 2003
audswitch(2) audswitch(2)
SEE ALSO [Toc] [Back]
audit(5), setaudproc(2), audusr(1M), audevent(1M).
Hewlett-Packard Company - 2 - HP-UX 11i Version 2: August 2003 [ Back ] |
