Trusted Solaris Audit Administration

X Server Protocol Audit Records

These audit records are created by X windows calls and use of the X server. The records are sorted alphabetically by protocol; where possible, records with identical structure are listed together. The description of each record includes:

Table B-176 XClientConnect

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_ClientConnect

Client connection to Xserver 

9101

xl

0x08000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	xclient-token
	inaddr-token	 (IP address of client)
	iport-token	 (port on server)
	return-token

Table B-177 XClientDisconnect

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_ClientDisconnect

Client logout from Xserver 

9102

xl

0x08000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	xclient-token
	return-token

Table B-178 X Server Protocols - window operations

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_ChangeSaveSet

Change the saved set 

9108

xp

0x10000000 

AUE_ChangeWindowAttributes

Change window attributes 

9104

 

 

AUE_CirculateWindow

Circulate the window 

9115

 

 

AUE_ConfigureWindow

Configure the window 

9114

 

 

AUE_CreateWindow

Create window 

9103

 

 

AUE_DestroySubwindows

Destroy subwindows 

9107

 

 

AUE_DestroyWindow

Destroy window 

9106

 

 

AUE_GetGeometry

Get window geometry 

9116

 

 

AUE_GetWindowAttributes

Get window attributes 

9105

 

 

AUE_MapSubwindows

Map the subwindows 

9111

 

 

AUE_MapWindow

Map the window 

9110

 

 

AUE_QueryTree

Query window tree 

9117

 

 

AUE_ReparentWindow

Reparent the window 

9109

 

 

AUE_UnmapSubwindows

Unmap the subwindows 

9113

 

 

AUE_UnmapWindow

Unmap the window 

9112

 

 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xwindow-token	
	return-token

Table B-179 X Server Protocols - window properties

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_ChangeProperty

Change window property 

9120

xc

0x20000000 

AUE_DeleteProperty

Delete window property 

9121

xc

0x20000000 

AUE_GetProperty

Get window property 

9122

xp

0x10000000 

AUE_ListProperties

List window properties 

9123

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xwindow-token	
	xproperty-token	
	return-token

Table B-180 XGetAtomName, XInternAtom

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_GetAtomName

Get atom name 

9119

xs

0x80000000 

AUE_InternAtom

Fetch atom 

9118

xs

0x80000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	(if privilege used or required)
	xatom-token	 (atom string)
	return-token

Table B-181 XConvertSelection, XGetSelectionOwner, XSetSelectionOwner

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_ConvertSelection

Convert selection 

9126

xs

0x80000000 

AUE_GetSelectionOwner

Get selection owner 

9125

xs

0x80000000 

AUE_SetSelectionOwner

Set selection owner 

9124

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xclient-token	
	return-token

Table B-182 XGrabButton

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_GrabButton

Grab window button 

9130

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	(if privilege used or required)
	xwindow-token	(grabbing window id)
	xwindow-token	(current device focus)
	xcursor-token	
	return-token

Table B-183 XGrabPointer, XUngrabPointer, XUngrabButton

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_GrabPointer

Grab pointer 

9128

xs

0x80000000 

AUE_UngrabButton

Release window button 

9131

xs

0x80000000 

AUE_UngrabPointer

Release pointer 

9129

xs

0x80000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	(if privilege used or required)
	xwindow-token	(grabbing window id)
	xwindow-token	(current device focus)
	xcursor-token	
	return-token

Table B-184 XChangeActivePointerGrab

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_ChangeActivePointerGrab

Change active pointer grab 

9132

xs

0x80000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xcursor-token	
	return-token

Table B-185 XGrabKey, XUngrabKeyboard

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_GrabKey

Grab key 

9135

xs

0x80000000 

AUE_UngrabKeyboard

Release keyboard 

9134

xs

0x80000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xwindow-token	
	return-token

Table B-186 XGrabKeyboard, XUngrabKey

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_GrabKeyboard

Grab keyboard 

9133

xp

0x10000000 

AUE_UngrabKey

Release key 

9135

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xwindow-token	
	return-token

Table B-187 XGrabServer, XUngrabServer

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_GrabServer

Grab the server 

9137

xa

0x40000000 

AUE_UngrabServer

Release the server 

9138

xa

0x40000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xclient-token	
	return-token

Table B-188 XQueryPointer

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_QueryPointer

Query pointer 

9139

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	(if privilege used or required)
	xwindow-token	(querying window id)
	xwindow-token	(pointer's window id)
	return-token

Table B-189 XGetMotionEvents, XSendEvent

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_GetMotionEvents

Get motion events 

9140

xp

0x10000000 

AUE_SendEvent

Send window event 

9127

xs

0x80000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xwindow-token	
	return-token

Table B-190 XTranslateCoords, XWarpPointer

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_TranslateCoords

Translate coordinates 

9141

xp

0x10000000 

AUE_WarpPointer

Warp the pointer 

9142

xs

0x80000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	      (if privilege used or required)
	xwindow-token (source window id)
	xwindow-token (destination window id)
	return-token

Table B-191 XGetInputFocus, XSetInputFocus

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_GetInputFocus

Get input focus 

9144

xs

0x80000000 

AUE_SetInputFocus

Set input focus 

9143

xs

0x80000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xwindow-token	
	return-token

Table B-192 XQueryKeymap

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_QueryKeymap

Query keymap 

9145

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xclient-token	
	return-token

Table B-193 XSetFontPath

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_SetFontPath

Set font path 

9146

xa

0x40000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xwindow-token	 
	xfont-token	 
	return-token

Table B-194 XChangeGC

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_ChangeGC

Change graphical context 

9148

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xfont-token	 
	xpixmap-token	 
	xgc-token	 
	return-token

Table B-195 XCopyGC

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_CopyGC

Copy graphical context 

9149

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	(if privilege used or required)
	xgc-token	 (source gc ID)
	xgc-token	 (destination gc ID)
	return-token

Table B-196 XFreeGC, XSetClipRectangles, XSetDashes

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_FreeGC

Free graphical context 

9152

xc

0x20000000 

AUE_SetClipRectangles

Set clip rectangles 

9151

xp

0x10000000 

AUE_SetDashes

Set dashes 

9150

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xgc-token	
	return-token

Table B-197 XClearArea

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_ClearArea

Clear area 

9153

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	(if privilege used or required)
	xwindow-token	
	return-token

Table B-198 XCopyArea, XCopyPlane

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_CopyArea

Copy area 

9154

xs

0x80000000 

AUE_CopyPlane

Copy plane 

9155

xs

0x80000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	(if privilege used or required)
	xpixmap-token	(source pixmap ID)
	xpixmap-token	(destination pixmap ID)
	xgc-token	
	return-token

Table B-199 XFillPolygon, XPolyArc, XPolyFillArc, XPolyFillRectangle, XPolyLine, XPolyPoint, XPolyRectangle, XPolySegment

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_FillPolygon

Fill polygon 

9161

xp

0x10000000 

AUE_PolyArc

Polyarc 

9160

xp

0x10000000 

AUE_PolyFillArc

Fill polyarc 

9163

xp

0x10000000 

AUE_PolyFillRectangle

Fill polyrectangle 

9162

xp

0x10000000 

AUE_PolyLine

Polyline 

9157

xp

0x10000000 

AUE_PolyPoint

Polypoint 

9156

xp

0x10000000 

AUE_PolyRectangle

Polyrectangle 

9159

xs

0x80000000 

AUE_PolySegment

Polysegment 

9158

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xwindow-token	
	xpixmap-token	
	xgc-token	
	return-token

Table B-200 XGetImage, XImageText8, XImageText16, XPolyText8, XPolyText16, XPutImage

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_GetImage

Get image 

9165

xs

0x80000000 

AUE_ImageText8

Imagetext (8-bit) 

9168

xp

0x10000000 

AUE_ImageText16

Imagetext (16-bit) 

9169

xp

0x10000000 

AUE_PolyText8

Polytext (8-bit) 

9166

xp

0x10000000 

AUE_PolyText16

Polytext (16-bit) 

9167

xp

0x10000000 

AUE_PutImage

Put image 

9164

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xwindow-token	
	xpixmap-token	
	xgc-token	
	return-token

Table B-201 XCreateColormap

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_CreateColormap

Create colormap 

9170

xc

0x20000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xwindow-token	
	return-token

Table B-202 XAllocColor, XAllocColorCells, XAllocColorPlanes, XAllocNamedColor, XFreeColors

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_AllocColor

Allocate color 

9176

xc

0x20000000 

AUE_AllocColorCells

Allocate color cells 

9178

 

 

AUE_AllocColorPlanes

Allocate color planes 

9179

 

 

AUE_AllocNamedColor

Allocate named color 

9177

 

 

AUE_FreeColors

Free colors 

9180

 

 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xcolormap-token	
	return-token

Table B-203 XCopyColormapAndFree, XFreeColormap, XInstallColormap, XListInstalledColormap, XUninstallColormap

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_CopyColormapAndFree

Copy and free colormap 

9172

xp

0x10000000 

AUE_FreeColormap

Free colormap 

9171

xp

0x10000000 

AUE_InstallColormap

Install colormap 

9173

xa

0x40000000 

AUE_ListInstalledColormap

List installed colormap 

9175

xs

0x80000000 

AUE_UninstallColormap

Uninstall colormap 

9174

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xcolormap-token	
	return-token

Table B-204 XLookupColor, XQueryColors, XStoreColors, XStoreNamedColor

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_LookupColor

Look up colors 

9184

xp

0x10000000 

AUE_QueryColors

Query colors 

9183

xp

0x10000000 

AUE_StoreColors

Store colors 

9181

xp

0x10000000 

AUE_StoreNamedColor

Store named colors 

9182

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xcolormap-token	
	return-token

Table B-205 XCreateCursor

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_CreateCursor

Create cursor 

9185

xc

0x20000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	(if privilege used or required)
	xpixmap-token	(source pixmap ID)
	xpixmap-token	(mask pixmap ID)
	xcursor-token	
	return-token

Table B-206 XCreateGlyphCursor

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_CreateGlyphCursor

Create glyph cursor 

9186

xc

0x20000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	(if privilege used or required)
	xfont-token	(source font ID)
	xfont-token	(mask font ID)
	xcursor-token	
	return-token

Table B-207 XFreeCursor, XRecolorCursor

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_FreeCursor

Free cursor 

9187

xc

0x20000000 

AUE_RecolorCursor

Recolor cursor 

9188

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xcursor-token	
	return-token

Table B-208 XFreePixmap

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_FreePixmap

Free pixmap 

9147

xc

0x20000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xpixmap-token	 
	return-token

Table B-209 XBell, XChangeKeyboardControl, XChangeKeyboardMapping, XChangePointerControl

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_Bell

Bell 

9193

xs

0x80000000 

AUE_ChangeKeyboardControl

Change keyboard control 

9190

 

 

AUE_ChangeKeyboardMapping

Change keyboard mapping 

9189

 

 

AUE_ChangePointerControl

Change pointer control 

9192

 

 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xclient-token	
	return-token

Table B-210 XForceScreenSaver, XSetScreenSaver

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_ForceScreenSaver

Cover screen 

9199

xp

0x10000000 

AUE_SetScreenSaver

Set screensaver 

9193

 

 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xclient-token	
	return-token

Table B-211 XSetCloseDownMode

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_SetCloseDownMode

Set closedown mode 

9196

xs

0x80000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xclient-token	
	return-token

Table B-212 XChangeHosts, XKillClient, XSetAccessControl

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_ChangeHosts

Change hosts 

9194

xa

0x40000000 

AUE_KillClient

Kill client 

9197

xc

0x20000000 

AUE_SetAccessControl

Set access control 

9195

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	(if privilege used or required)
	xclient-token	 
	return-token

Table B-213 XRotateProperties

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_RotateProperties

Rotate properties 

9198

xp

0x10000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xwindow-token	
	xproperty-token	
	return-token

Table B-214 XSetModifierMapping, XSetPointerMapping

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_SetModifierMapping

Set modifier mapping 

9201

xs

0x80000000 

AUE_SetPointerMapping

Set pointer mapping 

9200

xs

0x80000000 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xclient-token	
	return-token

Table B-215 X Server Extensions

Event Name 

Message 

Event ID 

Event Class 

Mask 

AUE_XExtensions

X extension protocols 

9202

xp

 

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]	 (if privilege used or required)
	xclient-token	
	return-token

The AUE_XExtensions audit record format is used when auditing extensions to the X11 library, such as XTSOLMakeTPWindow.