audctl.2 (2010 09)

a
audctl(2) audctl(2)
(TO BE OBSOLETED)
ignored. The auditing system begins writing to the new "current" file. If the audit-
ing system is off, no action is performed;
-1 is returned, and errno is set to EAL-
READY. If the auditing system is on and there is no available "next" file, no action
is performed; -1 is returned, and errno
is set to [ENOENT].
AUD_OFF The caller issues the AUD_OFF command to halt the auditing system. If the audit-
ing system is on, it is turned off and the "current" and "next" audit files are closed.
cpath , npath , and mode are ignored. If the audit system is already off,
-1 is
returned and
errno is set to [EALREADY].
Security Restrictions
Some or all of the actions associated with this system call require the
AUDCONTROL privilege. Processes
owned by the superuser have this privilege. Processes owned by other users may have this privilege,
depending on system configuration. See privileges (5) for more information about privileged access on sys-
tems that support fine-grained privileges.
RETURN VALUE
Upon successful completion, a value of
0 is returned. Otherwise,
-1 is returned and the global variable
errno is set to indicate the error.
EXAMPLES
In the following example,
audctl() is used to determine whether the auditing system is on, and to
retrieve the names of the audit files that are currently in use by the system.
char c_file[PATH_MAX+1], x_file[PATH_MAX+1];
int mode=0600;
if (audctl(AUD_GET, c_file, x_file, mode))
switch ( errno ) {
case ENOENT:
strcpy(x_file,"-none-");
break;
case EALREADY:
printf("The auditing system is OFF\n");
return 0;
case default:
fprintf(stderr, "Audctl failed: errno=%d\n", errno);
return 1;
}
printf("The auditing system is ON: c_file=%s x_file=%s\n",
c_file, x_file);
return 0;
ERRORS
audctl() fails if one of the following is true:
[EPERM] The caller does not have the
AUDCONTROL privilege, or one or both of the given
files are not regular files and cannot be used.
[EALREADY] The
AUD_OFF, AUD_SET, AUD_SETCURR, AUD_SETNEXT, AUD_SWITCH,or
AUD_GET cmd was specified while the auditing system is off.
[EBUSY] User attempt to start the auditing system failed because auditing is already on.
[EFAULT] Bad pointer. One or more of the required function parameters is not accessible.
[EINVAL] The cpath or npath is greater than
PATH_MAX in length, the cpath or npath
specified is not an absolute path name.
[ENOENT] No available "next" file when cmd is
AUD_GET or AUD_SWITCH.
AUTHOR
audctl() was developed by HP.
2 Hewlett-Packard Company − 2 − HP-UX 11i Version 3: September 2010