satd(4) satd(4)
satd - system auditing file format.
#include <sys/sat.h>
An audit file consists of an Audit File Header followed by a number of
AUDIT RECORDS.
A new audit record is created for each auditable event.
An Audit Record consists of an Audit Record Header Token followed by a
number of Audit Tokens.
An Audit Token consists of an Audit Token Header followed by token data
which is specific to each token. The Audit Token Header consists of an
unsigned 16 bit token identifier and an unsigned 16 bit token size field.
The contents of the Audit File Header are:
________________________________________________________________________________
| Field | Size in Bytes | Value | Description |
|______________|_______________|__________|_____________________________________|
|File HeaderID | 8 | SGIAUDIT | File ID |
|______________|_______________|__________|_____________________________________|
| sat_major | 1 | | Audit Major Version Number |
|______________|_______________|__________|_____________________________________|
| sat_minor | 1 | | Audit Minor Version Number |
|______________|_______________|__________|_____________________________________|
| sat_pad1 | 2 | | Alignment Filler |
|______________|_______________|__________|_____________________________________|
| start time | 4 | | Time Header was written |
|______________|_______________|__________|_____________________________________|
| stop time | 4 | | Time file closed |
|______________|_______________|__________|_____________________________________|
| Host ID | 4 | | Host IP Number |
|______________|_______________|__________|_____________________________________|
| MAC enabled | 4 | boolean | Ignore MAC fields? |
|______________|_______________|__________|_____________________________________|
| CAP enabled | 4 | boolean | Ignore CAP fields? |
|______________|_______________|__________|_____________________________________|
|CIPSO enabled | 4 | boolean | Ignore CIPSO fields? |
|______________|_______________|__________|_____________________________________|
| total bytes | 4 | | Number of Bytes to skip past Header |
|______________|_______________|__________|_____________________________________|
Page 1
satd(4) satd(4)
______________________________________________________________________________
| Field | Size in Bytes | Value | Description |
|__________________|_______________|_______|_________________________________|
| User entries | 2 | | Number of entries in user list |
|__________________|_______________|_______|_________________________________|
| Group entries | 2 | | Number of entries in group list |
|__________________|_______________|_______|_________________________________|
| Host entries | 2 | | Number of hosts |
|__________________|_______________|_______|_________________________________|
| Timezone length | 1 | | Length of timezone string |
|__________________|_______________|_______|_________________________________|
| Hostname length | 1 | | Length of Hostname name string |
|__________________|_______________|_______|_________________________________|
|Domainname length | 1 | | Length of Domain name string |
|__________________|_______________|_______|_________________________________|
| sat_pad2 | 3 | | Alignment filler |
|__________________|_______________|_______|_________________________________|
| Timezone | | | Time Zone string |
|__________________|_______________|_______|_________________________________|
| Hostname | | | Host name string |
|__________________|_______________|_______|_________________________________|
| Domainname | | | Domain name string |
|__________________|_______________|_______|_________________________________|
| User entries | | | Users list |
|__________________|_______________|_______|_________________________________|
| Group entries | | | Groups list |
|__________________|_______________|_______|_________________________________|
| Host ID entries | | | Hosts List |
|__________________|_______________|_______|_________________________________|
Page 2
satd(4) satd(4)
The contents of the Record Header Token are:
_____________________________________________________________________
| Field | Size in Bytes | Value | Description |
|_____________|_______________|____________|_________________________|
| Token ID | 2 | 0x0001 | SAT_RECORD_HEADER_TOKEN |
|_____________|_______________|____________|_________________________|
| Token Size | 2 | 14 | |
|_____________|_______________|____________|_________________________|
|Magic Number | 4 | 0xee6540ee | SAT_RECORD_MAGIC |
|_____________|_______________|____________|_________________________|
|Record Size | 2 | | Total Size of Record |
|_____________|_______________|____________|_________________________|
|Record Type | 1 | | Kind of event |
|_____________|_______________|____________|_________________________|
| Outcome | 1 | | Event Outcome |
|_____________|_______________|____________|_________________________|
| Sequence | 1 | | within event |
|_____________|_______________|____________|_________________________|
|Error Number | 1 | | errno |
|_____________|_______________|____________|_________________________|
The contents of the Audit Tokens are:
_________________________________________________________
| SAT_IFREQ_TOKEN |
|________________________________________________________|
| Field | Size in Bytes | Value | Description |
|_____________|_______________|________|_________________|
| Token ID | 2 | 0x0002 | SAT_IFREQ_TOKEN |
|_____________|_______________|________|_________________|
| Token Size | 2 | 36 | |
|_____________|_______________|________|_________________|
|Struct ifreq | 32 | | from <sys/if.h> |
|_____________|_______________|________|_________________|
__________________________________________________________
| SAT_PROTOCOL_TOKEN |
|_________________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|_______________|________|____________________|
| Token ID | 2 | 0x0003 | SAT_PROTOCOL_TOKEN |
|___________|_______________|________|____________________|
|Token Size | 2 | 8 | |
|___________|_______________|________|____________________|
| Domain | 2 | | Domain |
|___________|_______________|________|____________________|
| Protocol | 2 | | Protocol |
|___________|_______________|________|____________________|
Page 3
satd(4) satd(4)
______________________________________________________
| SAT_TIME_TOKEN |
|_____________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|_______________|________|________________|
| Token ID | 2 | 0x0004 | SAT_TIME_TOKEN |
|___________|_______________|________|________________|
|Token Size | 2 | 9 | |
|___________|_______________|________|________________|
| Time | 4 | | Time |
|___________|_______________|________|________________|
| Ticks | 1 | | Ticks |
|___________|_______________|________|________________|
____________________________________________________________________
| SAT_SYSCALL_TOKEN |
|___________________________________________________________________|
| Field | Size in Bytes | Value | Description |
|____________________|_______________|________|_____________________|
| Token ID | 2 | 0x0005 | SAT_SYSCALL_TOKEN |
|____________________|_______________|________|_____________________|
| Token Size | 2 | 7 | |
|____________________|_______________|________|_____________________|
| Sys Call No. | 1 | | Sys Call No. |
|____________________|_______________|________|_____________________|
|Sys Call Vector No. | 2 | | Sys Call Vector No. |
|____________________|_______________|________|_____________________|
______________________________________________________
| SAT_UGID_TOKEN |
|_____________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|_______________|________|________________|
| Token ID | 2 | 0x0006 | SAT_UGID_TOKEN |
|___________|_______________|________|________________|
|Token Size | 2 | 12 | |
|___________|_______________|________|________________|
| User ID | 4 | | User ID |
|___________|_______________|________|________________|
| Group ID | 4 | | Group ID |
|___________|_______________|________|________________|
Page 4
satd(4) satd(4)
___________________________________________________________________________
| SAT_FILE_TOKEN |
|_________________________________________________________________________|
| Field | Size in Bytes | Value | Description |
|_______________________|_______________|________|________________________|
| Token ID | 2 | 0x0007 | SAT_FILE_TOKEN |
|_______________________|_______________|________|________________________|
| Token Size | 2 | 16 | |
|_______________________|_______________|________|________________________|
|File Identifier(inode) | 8 | | File Identifier(inode) |
|_______________________|_______________|________|________________________|
| dev_t | 4 | | from <sys/types.h> |
|_______________________|_______________|________|________________________|
________________________________________________________________
| SAT_SOCKADDER_TOKEN |
|_______________________________________________________________|
| Field | Size in Bytes | Value | Description |
|________________|_______________|________|_____________________|
| Token ID | 2 | 0x0008 | SAT_SOCKADDER_TOKEN |
|________________|_______________|________|_____________________|
| Token Size | 2 | 20 | |
|________________|_______________|________|_____________________|
|Struct sockaddr | 16 | | from <sys/socket.h> |
|________________|_______________|________|_____________________|
Page 5
satd(4) satd(4)
____________________________________________________________
| SAT_IP_HEADER_TOKEN |
|__________________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|_______________|________|_____________________|
| Token ID | 2 | 0x0009 | SAT_IP_HEADER_TOKEN |
|___________|_______________|________|_____________________|
|Token Size | 2 | 24 | |
|___________|_______________|________|_____________________|
|Struct ip | 20 | | netinet/ip.h |
|___________|_______________|________|_____________________|
___________________________________________________________
| SAT_GID_LIST_TOKEN |
|__________________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|________________|________|____________________|
| Token ID | 2 | 0x000a | SAT_GID_LIST_TOKEN |
|___________|________________|________|____________________|
|Token Size | 2 | | |
|___________|________________|________|____________________|
|Group IDs | (Token Size)-4 | | Group IDs |
|___________|________________|________|____________________|
___________________________________________________________
| SAT_UID_LIST_TOKEN |
|__________________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|________________|________|____________________|
| Token ID | 2 | 0x000b | SAT_UID_LIST_TOKEN |
|___________|________________|________|____________________|
|Token Size | 2 | | |
|___________|________________|________|____________________|
| User IDs | (Token Size)-4 | | User IDs |
|___________|________________|________|____________________|
_________________________________________________________________________
| SAT_SYSARG_LIST_TOKEN |
|________________________________________________________________________|
| Field | Size in Bytes | Value | Description |
|______________________|________________|________|_______________________|
| Token ID | 2 | 0x000c | SAT_SYSARG_LIST_TOKEN |
|______________________|________________|________|_______________________|
| Token Size | 2 | | |
|______________________|________________|________|_______________________|
|System Call Arguments | (Token Size)-4 | | System Call Arguments |
|______________________|________________|________|_______________________|
Page 6
satd(4) satd(4)
___________________________________________________________________
| SAT_DESCRIPTOR_LIST_TOKEN |
|__________________________________________________________________|
| Field | Size in Bytes | Value | Description |
|____________|________________|________|___________________________|
| Token ID | 2 | 0x000d | SAT_DESCRIPTOR_LIST_TOKEN |
|____________|________________|________|___________________________|
|Token Size | 2 | | |
|____________|________________|________|___________________________|
|Descriptors | (Token Size)-4 | | Descriptors |
|____________|________________|________|___________________________|
____________________________________________________________
| SAT_IFNAME_TOKEN |
|___________________________________________________________|
| Field | Size in Bytes | Value | Description |
|_______________|_______________|________|__________________|
| Token ID | 2 | 0x000e | SAT_IFNAME_TOKEN |
|_______________|_______________|________|__________________|
| Token Size | 2 | 20 | |
|_______________|_______________|________|__________________|
|Interface Name | 16 | | Interface Name |
|_______________|_______________|________|__________________|
________________________________________________________
| SAT_SOCKET_TOKEN |
|_______________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|_______________|________|__________________|
| Token ID | 2 | 0x000f | SAT_SOCKET_TOKEN |
|___________|_______________|________|__________________|
|Token Size | 2 | 12 | |
|___________|_______________|________|__________________|
|Socket ID | 8 | | Socket ID |
|___________|_______________|________|__________________|
_________________________________________________________________________
| SAT_MAC_LABEL_TOKEN |
|________________________________________________________________________|
| Field | Size in Bytes | Value | Description |
|_______________|_______________|__________________|_____________________|
| Token ID | 2 | 0x00010 | SAT_MAC_LABEL_TOKEN |
|_______________|_______________|__________________|_____________________|
| Token Size | 2 | | |
|_______________|_______________|__________________|_____________________|
|MAC Label Size | 2 | | MAC Label Size |
|_______________|_______________|__________________|_____________________|
| MAC Label | | struct mac_label | MAC Label |
|_______________|_______________|__________________|_____________________|
Page 7
satd(4) satd(4)
_____________________________________________________________
| SAT_ACL_TOKEN |
|___________________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|_______________|____________|__________________|
| Token ID | 2 | 0x00011 | SAT_ACL_TOKEN |
|___________|_______________|____________|__________________|
|Token Size | 2 | 258 | |
|___________|_______________|____________|__________________|
| acl_t | 254 | struct acl | from <sys/acl.h> |
|___________|_______________|____________|__________________|
________________________________________________________________
| SAT_CAP_VALUE_TOKEN |
|_______________________________________________________________|
| Field | Size in Bytes | Value | Description |
|____________|_______________|________|_________________________|
| Token ID | 2 | 0x0012 | SAT_CAP_VALUE_TOKEN |
|____________|_______________|________|_________________________|
|Token Size | 2 | 12 | |
|____________|_______________|________|_________________________|
|cap_value_t | 8 | | from <sys/capability.h> |
|____________|_______________|________|_________________________|
_______________________________________________________________
| SAT_CAP_SET_TOKEN |
|______________________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|_______________|________|_________________________|
| Token ID | 2 | 0x0013 | SAT_CAP_SET_TOKEN |
|___________|_______________|________|_________________________|
|Token Size | 2 | 28 | |
|___________|_______________|________|_________________________|
|cap_set_t | 24 | | from <sys/capability.h> |
|___________|_______________|________|_________________________|
Page 8
satd(4) satd(4)
_______________________________________________________
| SAT_TEXT_TOKEN |
|______________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|________________|________|________________|
| Token ID | 2 | 0x0014 | SAT_TEXT_TOKEN |
|___________|________________|________|________________|
|Token Size | 2 | | |
|___________|________________|________|________________|
| Text | (Token Size)-4 | | Text |
|___________|________________|________|________________|
_________________________________________________________________
| SAT_SVIPC_KEY_TOKEN |
|________________________________________________________________|
| Field | Size in Bytes | Value | Description |
|_________________|_______________|________|_____________________|
| Token ID | 2 | 0x0015 | SAT_SVIPC_KEY_TOKEN |
|_________________|_______________|________|_____________________|
| Token Size | 2 | 8 | |
|_________________|_______________|________|_____________________|
|System V IPC Key | 4 | | System V IPC Key |
|_________________|_______________|________|_____________________|
_______________________________________________________________
| SAT_SVIPC_ID_TOKEN |
|______________________________________________________________|
| Field | Size in Bytes | Value | Description |
|________________|_______________|________|____________________|
| Token ID | 2 | 0x0016 | SAT_SVIPC_ID_TOKEN |
|________________|_______________|________|____________________|
| Token Size | 2 | 8 | |
|________________|_______________|________|____________________|
|System V IPC ID | 4 | | System V IPC ID |
|________________|_______________|________|____________________|
______________________________________________________
| SAT_MODE_TOKEN |
|_____________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|_______________|________|________________|
| Token ID | 2 | 0x0017 | SAT_MODE_TOKEN |
|___________|_______________|________|________________|
|Token Size | 2 | 6 | |
|___________|_______________|________|________________|
|Mode bits | 2 | | Mode bits |
|___________|_______________|________|________________|
Page 9
satd(4) satd(4)
________________________________________________________
| SAT_PORT_TOKEN |
|______________________________________________________|
| Field | Size in Bytes | Value | Description |
|____________|_______________|________|________________|
| Token ID | 2 | 0x0018 | SAT_PORT_TOKEN |
|____________|_______________|________|________________|
|Token Size | 2 | 8 | |
|____________|_______________|________|________________|
|Port Number | 4 | | Port Number |
|____________|_______________|________|________________|
________________________________________________________
| SAT_HOSTID_TOKEN |
|_______________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|_______________|________|__________________|
| Token ID | 2 | 0x0019 | SAT_HOSTID_TOKEN |
|___________|_______________|________|__________________|
|Token Size | 2 | 8 | |
|___________|_______________|________|__________________|
| Host ID | 4 | | Host ID |
|___________|_______________|________|__________________|
________________________________________________________
| SAT_BINARY_TOKEN |
|_______________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|_______________|________|__________________|
| Token ID | 2 | 0x001a | SAT_BINARY_TOKEN |
|___________|_______________|________|__________________|
|Token Size | 2 | 5 | |
|___________|_______________|________|__________________|
| 1 or 0 | 1 | | 1 or 0 |
|___________|_______________|________|__________________|
_____________________________________________________
| SAT_PID_TOKEN |
|____________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|_______________|________|_______________|
| Token ID | 2 | 0x001b | SAT_PID_TOKEN |
|___________|_______________|________|_______________|
|Token Size | 2 | 8 | |
|___________|_______________|________|_______________|
|Process ID | 4 | | Process ID |
|___________|_______________|________|_______________|
Page 10
satd(4) satd(4)
__________________________________________________________________________
| SAT_PRIVILEGE_TOKEN |
|________________________________________________________________________|
| Field | Size in Bytes | Value | Description |
|__________________|_______________|________|____________________________|
| Token ID | 2 | 0x001c | SAT_PRIVILEGE_TOKEN |
|__________________|_______________|________|____________________________|
| Token Size | 2 | 13 | |
|__________________|_______________|________|____________________________|
| cap_value_t | 8 | | from <sys/capability.h> |
|__________________|_______________|________|____________________________|
|how privilege was | | | |
| obtained | 1 | | how privilege was obtained |
|__________________|_______________|________|____________________________|
_________________________________________________________
| SAT_ERRNO_TOKEN |
|________________________________________________________|
| Field | Size in Bytes | Value | Description |
|_____________|_______________|________|_________________|
| Token ID | 2 | 0x001d | SAT_ERRNO_TOKEN |
|_____________|_______________|________|_________________|
| Token Size | 2 | 5 | |
|_____________|_______________|________|_________________|
|Error Number | 1 | | Error Number |
|_____________|_______________|________|_________________|
__________________________________________________________
| SAT_SATID_TOKEN |
|_________________________________________________________|
| Field | Size in Bytes | Value | Description |
|______________|_______________|________|_________________|
| Token ID | 2 | 0x001e | SAT_SATID_TOKEN |
|______________|_______________|________|_________________|
| Token Size | 2 | 8 | |
|______________|_______________|________|_________________|
|Audit User ID | 4 | | Audit User ID |
|______________|_______________|________|_________________|
Page 11
satd(4) satd(4)
___________________________________________________________
| SAT_DEVICE_TOKEN |
|_________________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|_______________|________|____________________|
| Token ID | 2 | 0x001f | SAT_DEVICE_TOKEN |
|___________|_______________|________|____________________|
|Token Size | 2 | 8 | |
|___________|_______________|________|____________________|
| dev_t | 4 | | from <sys/types.h> |
|___________|_______________|________|____________________|
_________________________________________________________________
| SAT_TITLED_TEXT_TOKEN |
|________________________________________________________________|
| Field | Size in Bytes | Value | Description |
|_____________|_________________|________|_______________________|
| Token ID | 2 | 0x0020 | SAT_TITLED_TEXT_TOKEN |
|_____________|_________________|________|_______________________|
| Token Size | 2 | | |
|_____________|_________________|________|_______________________|
|Title String | 16 | | Title Text String |
|_____________|_________________|________|_______________________|
|Text String | (Token Size)-20 | | Text String |
|_____________|_________________|________|_______________________|
___________________________________________________________
| SAT_PATHNAME_TOKEN |
|__________________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|________________|________|____________________|
| Token ID | 2 | 0x0021 | SAT_PATHNAME_TOKEN |
|___________|________________|________|____________________|
|Token Size | 2 | | |
|___________|________________|________|____________________|
| Pathname | (Token Size)-4 | | Pathname |
|___________|________________|________|____________________|
__________________________________________________________
| SAT_OPENMODE_TOKEN |
|_________________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|_______________|________|____________________|
| Token ID | 2 | 0x0022 | SAT_OPENMODE_TOKEN |
|___________|_______________|________|____________________|
|Token Size | 2 | 8 | |
|___________|_______________|________|____________________|
|Open Flags | 4 | | Open Flags |
|___________|_______________|________|____________________|
Page 12
satd(4) satd(4)
___________________________________________________________
| SAT_SIGNAL_TOKEN |
|__________________________________________________________|
| Field | Size in Bytes | Value | Description |
|______________|_______________|________|__________________|
| Token ID | 2 | 0x0023 | SAT_SIGNAL_TOKEN |
|______________|_______________|________|__________________|
| Token Size | 2 | 8 | |
|______________|_______________|________|__________________|
|Signal Number | 4 | | Signal Number |
|______________|_______________|________|__________________|
________________________________________________________
| SAT_STATUS_TOKEN |
|_______________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|_______________|________|__________________|
| Token ID | 2 | 0x0024 | SAT_STATUS_TOKEN |
|___________|_______________|________|__________________|
|Token Size | 2 | 8 | |
|___________|_______________|________|__________________|
| Status | 4 | | Status |
|___________|_______________|________|__________________|
_________________________________________________________
| SAT_OPAQUE_TOKEN |
|________________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|________________|________|__________________|
| Token ID | 2 | 0x0025 | SAT_OPAQUE_TOKEN |
|___________|________________|________|__________________|
|Token Size | 2 | | |
|___________|________________|________|__________________|
| Data | (Token Size)-4 | | Data |
|___________|________________|________|__________________|
__________________________________________________________
| SAT_LOOKUP_TOKEN |
|_________________________________________________________|
| Field | Size in Bytes | Value | Description |
|____________|________________|________|__________________|
| Token ID | 2 | 0x0026 | SAT_LOOKUP_TOKEN |
|____________|________________|________|__________________|
|Token Size | 2 | | |
|____________|________________|________|__________________|
|Lookup Name | (Token Size)-4 | | Lookup Name |
|____________|________________|________|__________________|
Page 13
satd(4) satd(4)
__________________________________________________________________________
| SAT_CWD_TOKEN |
|________________________________________________________________________|
| Field | Size in Bytes | Value | Description |
|__________________|________________|________|___________________________|
| Token ID | 2 | 0x0027 | SAT_CWD_TOKEN |
|__________________|________________|________|___________________________|
| Token Size | 2 | | |
|__________________|________________|________|___________________________|
| Current | | | |
|Working Directory | (Token Size)-4 | | Current Working Directory |
|__________________|________________|________|___________________________|
___________________________________________________________
| SAT_ROOT_TOKEN |
|__________________________________________________________|
| Field | Size in Bytes | Value | Description |
|_______________|________________|________|________________|
| Token ID | 2 | 0x0028 | SAT_ROOT_TOKEN |
|_______________|________________|________|________________|
| Token Size | 2 | | |
|_______________|________________|________|________________|
|Root Directory | (Token Size)-4 | | Root Directory |
|_______________|________________|________|________________|
____________________________________________________________
| SAT_PARENT_PID_TOKEN |
|___________________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|_______________|________|______________________|
| Token ID | 2 | 0x0029 | SAT_PARENT_PID_TOKEN |
|___________|_______________|________|______________________|
|Token Size | 2 | 8 | |
|___________|_______________|________|______________________|
| PPID | 4 | | Parent Process ID |
|___________|_______________|________|______________________|
____________________________________________________________
| SAT_COMMAND_TOKEN |
|___________________________________________________________|
| Field | Size in Bytes | Value | Description |
|_____________|________________|________|___________________|
| Token ID | 2 | 0x002a | SAT_COMMAND_TOKEN |
|_____________|________________|________|___________________|
| Token Size | 2 | | |
|_____________|________________|________|___________________|
|Command Name | (Token Size)-4 | | Command Name |
|_____________|________________|________|___________________|
Page 14
satd(4) satd(4)
______________________________________________________________
| SAT_ACCT_COUNTS_TOKEN |
|_____________________________________________________________|
| Field | Size in Bytes | Value | Description |
|____________|_______________|________|_______________________|
| Token ID | 2 | 0x002b | SAT_ACCT_COUNTS_TOKEN |
|____________|_______________|________|_______________________|
|Token Size | 2 | 100 | |
|____________|_______________|________|_______________________|
|acct_counts | 96 | | |
|____________|_______________|________|_______________________|
_____________________________________________________________________
| SAT_ACCT_TIMERS_TOKEN |
|____________________________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________________|_______________|________|_______________________|
| Token ID | 2 | 0x002c | SAT_ACCT_TIMERS_TOKEN |
|___________________|_______________|________|_______________________|
| Token Size | 2 | 68 | |
|___________________|_______________|________|_______________________|
|Struct acct_timers | 64 | | from <sys/extacct.h> |
|___________________|_______________|________|_______________________|
______________________________________________________________________
| SAT_ACCT_PROC_TOKEN |
|_____________________________________________________________________|
| Field | Size in Bytes | Value | Description |
|_____________________|_______________|________|______________________|
| Token ID | 2 | 0x002d | SAT_ACCT_PROC_TOKEN |
|_____________________|_______________|________|______________________|
| Token Size | 2 | 44 | |
|_____________________|_______________|________|______________________|
|Struct sat_proc_acct | 40 | | from <sys/extacct.h> |
|_____________________|_______________|________|______________________|
____________________________________________________________________
| SAT_ACCT_SESSION_TOKEN |
|___________________________________________________________________|
| Field | Size in Bytes | Value | Description |
|_________________|_______________|________|________________________|
| Token ID | 2 | 0x002e | SAT_ACCT_SESSION_TOKEN |
|_________________|_______________|________|________________________|
| Token Size | 2 | 44 | |
|_________________|_______________|________|________________________|
| Struct | | | |
|sat_session_acct | 40 | | from <sys/extacct.h> |
|_________________|_______________|________|________________________|
Page 15
satd(4) satd(4)
_________________________________________________________________
| SAT_ACCT_SPI_TOKEN |
|________________________________________________________________|
| Field | Size in Bytes | Value | Description |
|________________|_______________|________|______________________|
| Token ID | 2 | 0x002f | SAT_ACCT_SPI_TOKEN |
|________________|_______________|________|______________________|
| Token Size | 2 | 68 | |
|________________|_______________|________|______________________|
|Struct acct_spi | 64 | | from <sys/extacct.h> |
|________________|_______________|________|______________________|
___________________________________________________________
| SAT_ACCT_SPI2_TOKEN |
|__________________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|_______________|________|_____________________|
| Token ID | 2 | 0x0030 | SAT_ACCT_SPI2_TOKEN |
|___________|_______________|________|_____________________|
|Token Size | 2 | | |
|___________|_______________|________|_____________________|
| SPI Size | SPI Size | | SPI |
|___________|_______________|________|_____________________|
_________________________________________________________
| SAT_OBJECT_TOKEN |
|________________________________________________________|
| Field | Size in Bytes | Value | Description |
|___________|________________|________|__________________|
| Token ID | 2 | 0x0031 | SAT_OBJECT_TOKEN |
|___________|________________|________|__________________|
|Token Size | 2 | | |
|___________|________________|________|__________________|
| Text | (Token Size)-4 | | Text |
|___________|________________|________|__________________|
Page 16
satd(4) satd(4)
NOTE: Audit records only appear if satd is configured to record them (see
sat_select(1)).
_____________________________________
| RECORD TYPE DEFINITIONS |
|____________________________________|
| Record Type | Record Number |
|____________________|_______________|
| SAT_FILE_HEADER | 0 |
|____________________|_______________|
| SAT_ACCESS_DENIED | 1 |
|____________________|_______________|
| SAT_ACCESS_FAILED | 2 |
|____________________|_______________|
| SAT_CHDIR | 3 |
|____________________|_______________|
| SAT_CHROOT | 4 |
|____________________|_______________|
| SAT_OPEN | 5 |
|____________________|_______________|
| SAT_OPEN_RO | 6 |
|____________________|_______________|
| SAT_READ_SYMLINK | 7 |
|____________________|_______________|
| SAT_FILE_CRT_DEL | 8 |
|____________________|_______________|
| SAT_FILE_CRT_DEL2 | 9 |
|____________________|_______________|
| SAT_FILE_WRITE | 10 |
|____________________|_______________|
| SAT_MOUNT | 11 |
|____________________|_______________|
|SAT_FILE_ATTR_READ | 12 |
|____________________|_______________|
|SAT_FILE_ATTR_WRITE | 13 |
|____________________|_______________|
| SAT_EXEC | 14 |
|____________________|_______________|
| SAT_SYSACCT | 15 |
|____________________|_______________|
| SAT_FCHDIR | 20 |
|____________________|_______________|
| SAT_FD_READ | 21 |
|____________________|_______________|
| SAT_FD_READ2 | 22 |
|____________________|_______________|
| SAT_TTY_SETLABEL | 23 |
|____________________|_______________|
| SAT_FD_WRITE | 24 |
|____________________|_______________|
Page 17
satd(4) satd(4)
________________________________________________
| RECORD TYPE DEFINITIONS |
|_______________________________________________|
| Record Type | Record Number |
|________________________|______________________|
| | |
| SAT_FD_ATTR_WRITE | 25 |
|________________________|______________________|
| SAT_PIPE | 26 |
|________________________|______________________|
| SAT_DUP | 27 |
|________________________|______________________|
| SAT_CLOSE | 28 |
|________________________|______________________|
| SAT_FORK | 40 |
|________________________|______________________|
| SAT_EXIT | 41 |
|________________________|______________________|
| SAT_PROC_READ | 42 |
|________________________|______________________|
| SAT_PROC_WRITE | 43 |
|________________________|______________________|
| SAT_PROC_ATTR_READ | 44 |
|________________________|______________________|
| SAT_PROC_ATTR_WRITE | 45 |
|________________________|______________________|
|SAT_PROC_OWN_ATTR_WRITE | 46 |
|________________________|______________________|
| SAT_PROC_ACCT | 47 |
|________________________|______________________|
| SAT_SESSION_ACCT | 48 |
|________________________|______________________|
| SAT_SVIPC_ACCESS | 50 |
|________________________|______________________|
| SAT_SVIPC_CREATE | 51 |
|________________________|______________________|
| SAT_SVIPC_REMOVE | 52 |
|________________________|______________________|
| SAT_SVIPC_CHANGE | 53 |
|________________________|______________________|
| SAT_BSDIPC_CREATE | 60 |
|________________________|______________________|
|SAT_BSDIPC_CREATE_PAIR | 61 |
|________________________|______________________|
| SAT_BSDIPC_SHUTDOWN | 62 |
|________________________|______________________|
| SAT_BSDIPC_MAC_CHANGE | 63 |
|________________________|______________________|
Page 18
satd(4) satd(4)
___________________________________________________
| RECORD TYPE DEFINITIONS |
|_________________________________________________|
| Record Type | Record Number |
|______________________|__________________________|
| SAT_BSDIPC_ADDRESS | 64 |
|______________________|__________________________|
| SAT_BSDIPC_RESVPORT | 65 |
|______________________|__________________________|
| SAT_BSDIPC_DELIVER | 66 |
|______________________|__________________________|
| SAT_BSDIPC_CANTFIND | 67 |
|______________________|__________________________|
| SAT_BSDIPC_SNOOP_OK | 68 |
|______________________|__________________________|
|SAT_BSDIPC_SNOOP_FAIL | 69 |
|______________________|__________________________|
| SAT_CLOCK_SET | 70 |
|______________________|__________________________|
| SAT_HOSTNAME_SET | 71 |
|______________________|__________________________|
| SAT_DOMAINNAME_SET | 72 |
|______________________|__________________________|
| SAT_HOSTID_SET | 73 |
|______________________|__________________________|
| SAT_CHECK_PRIV | 80 |
|______________________|__________________________|
| SAT_CONTROL | 81 |
|______________________|__________________________|
| SAT_SYS_NOTE | 82 |
|______________________|__________________________|
|SAT_BSDIPC_DAC_CHANGE | 87 |
|______________________|__________________________|
|SAT_BSDIPC_DAC_DENIED | 88 |
|______________________|__________________________|
|SAT_BSDIPC_IF_SETUID | 89 |
|______________________|__________________________|
| SAT_BSDIPC_RX_OK | 90 |
|______________________|__________________________|
| SAT_BSDIPC_RX_RANGE | 91 |
|______________________|__________________________|
|SAT_BSDIPC_RX_MISSING | 92 |
|______________________|__________________________|
| SAT_BSDIPC_TX_OK | 93 |
|______________________|__________________________|
| SAT_BSDIPC_TX_RANGE | 94 |
|______________________|__________________________|
|SAT_BSDIPC_TX_TOOBIG | 95 |
|______________________|__________________________|
Page 19
satd(4) satd(4)
______________________________________________________
| RECORD TYPE DEFINITIONS |
|_____________________________________________________|
| Record Type | Record Number |
|____________________________|________________________|
| SAT_BSDIPC_IF_CONFIG | 96 |
|____________________________|________________________|
| SAT_BSDIPC_IF_INVALID | 97 |
|____________________________|________________________|
| SAT_BSDIPC_IF_SETLABEL | 98 |
|____________________________|________________________|
| SAT_USER_RECORDS | 100 |
|____________________________|________________________|
| SAT_AE_AUDIT | 100 |
|____________________________|________________________|
| SAT_AE_IDENTITY | 101 |
|____________________________|________________________|
| SAT_AE_DBEDIT | 102 |
|____________________________|________________________|
| SAT_AE_MOUNT | 103 |
|____________________________|________________________|
| SAT_AE_CUSTOM | 104 |
|____________________________|________________________|
| SAT_AE_LP | 105 |
|____________________________|________________________|
| SAT_AE_X_ALLOWED | 106 |
|____________________________|________________________|
| SAT_AE_X_DENIED | 107 |
|____________________________|________________________|
| SAT_SVR4NET_CREATE | 120 |
|____________________________|________________________|
| SAT_SVR4NET_ADDRESS | 121 |
|____________________________|________________________|
| SAT_SVR4NET_SHUTDOWN | 122 |
|____________________________|________________________|
|SAT_PROC_OWN_EXT_ATTR_WRITE | 123 |
|____________________________|________________________|
| SAT_NTYPES | 130 |
|____________________________|________________________|
satd(1M), sat_interpret(1M), sat_reduce(1M), sat_select(1M),
sat_summarize(1M), satread(2).
PPPPaaaaggggeeee 22220000 [ Back ]
|
