audctl.2 (2010 09)

ManualsBrandsHP ManualsSoftwareHP-UX Manpages

audctl(2) audctl(2)

(TO BE OBSOLETED)

NAME

audctl() - start or halt the auditing system and set or get audit ﬁles

SYNOPSIS

#include <sys/audit.h>

int audctl(int cmd, char *cpath, char *npath, mode_t mode);

Remarks

This function is provided purely for backward compatibility. HP recommends that new applications use

the audsys command to conﬁgure the auditing system. See audsys (1M).

DESCRIPTION

audctl() sets or gets the auditing system "current" and "next" audit ﬁles, and starts or halts the audit-

ing system. This call is restricted to processes with the

AUDCONTROL privilege. cpath and npath hold

the absolute path names of the "current" and "next" ﬁles. mode speciﬁes the audit ﬁle’s permission bits.

cmd is one of the following speciﬁcations:

AUD_ON The caller issues the AUD_ON command with the required "current" and "next" ﬁles

to turn on the auditing system. If the auditing system is currently off, it is turned

on; the ﬁle speciﬁed by the cpath parameter is used as the "current" audit ﬁle, and

the ﬁle speciﬁed by the npath parameter is used as the "next" audit ﬁle. If the audit

ﬁles do not already exist, they are created with the mode speciﬁed. The auditing

system then begins writing to the speciﬁed "current" ﬁle. An empty string or NULL

npath can be speciﬁed if the caller wants to designate that no "next" ﬁle be available

to the auditing system. If the auditing system is already on, no action is performed;

-1 is returned and errno is set to [EBUSY].

AUD_GET The caller issues the AUD_GET command to retrieve the names of the "current" and

"next" audit ﬁles. If the auditing system is on, the names of the "current" and "next"

audit ﬁles are returned via the cpath and npath parameters (which must point to

character buffers of sufﬁcient size to hold the ﬁle names). mode is ignored. If the

auditing system is on and there is no available "next" ﬁle, the "current" audit ﬁle

name is returned via the cpath parameter, npath is set to an empty string;

-1

returned, and

errno is set to [ENOENT]. If the auditing system is off, no action is

performed; -1 is returned and errno is set to [EALREADY].

AUD_SET The caller issues the AUD_SET command to change both the "current" and "next"

ﬁles. If the audit system is on, the ﬁle speciﬁed by cpath is used as the "current"

audit ﬁle, and the ﬁle speciﬁed by npath is used as the "next" audit ﬁle. If the audit

ﬁles do not already exist, they are created with the speciﬁed mode. The auditing

system begins writing to the speciﬁed "current" ﬁle. Either an empty string or

NULL npath can be speciﬁed if the caller wants to designate that no "next" ﬁle be

available to the auditing system. If the auditing system is off, no action is per-

formed; -1 is returned and errno is set to [EALREADY].

AUD_SETCURR

The caller issues the AUD_SETCURR command to change only the "current" audit

ﬁle. If the audit system is on, the ﬁle speciﬁed by cpath is used as the "current"

audit ﬁle. If the speciﬁed "current" audit ﬁle does not exist, it is created with the

speciﬁed mode. npath is ignored. The auditing system begins writing to the

speciﬁed "current" ﬁle. If the audit system is off, no action is performed; -1 is

returned and errno is set to [EALREADY].

AUD_SETNEXT

The caller issues the AUD_SETNEXT command to change only the "next" audit ﬁle.

If the auditing system is on, the ﬁle speciﬁed by npath is used as the "next" audit

ﬁle. cpath is ignored. If the "next" audit ﬁle speciﬁed does not exist, it is created

with the speciﬁed mode. Either an empty string or NULL npath can be speciﬁed if

the caller wants to designate that no "next" ﬁle be available to the auditing system.

If the auditing system is off, no action is performed; -1 is returned, and errno is

set to [EALREADY].

AUD_SWITCH The caller issues the AUD_SWITCH command to cause the auditing system to switch

audit ﬁles. If the auditing system is on, it uses the "next" ﬁle as the new "current"

audit ﬁle and sets the new "next" audit ﬁle to NULL. cpath , npath ,and mode are

HP-UX 11i Version 3: September 2010 − 1 − Hewlett-Packard Company 1

Summary of content (4 pages)

PAGE 1
audctl(2) audctl(2) (TO BE OBSOLETED) NAME audctl() - start or halt the auditing system and set or get audit files SYNOPSIS #include int audctl(int cmd, char *cpath, char *npath, mode_t mode); Remarks This function is provided purely for backward compatibility. HP recommends that new applications use the audsys command to configure the auditing system. See audsys (1M).
PAGE 2
audctl(2) audctl(2) (TO BE OBSOLETED) ignored. The auditing system begins writing to the new "current" file. If the auditing system is off, no action is performed; -1 is returned, and errno is set to EALREADY. If the auditing system is on and there is no available "next" file, no action is performed; -1 is returned, and errno is set to [ENOENT]. The caller issues the AUD_OFF command to halt the auditing system.
PAGE 3
audctl(2) audctl(2) (TO BE OBSOLETED) SEE ALSO audomon(1M), audsys(1M), audit(5), privileges(5).
PAGE 4
(Notes) A (Notes) aA 4 Hewlett-Packard Company −1− HP-UX 11i Version 3: September 2010