Trusted Solaris Audit Administration

User-Level Generated Audit Records

These audit records are created by programs that operate outside the kernel. The records are sorted alphabetically by program. The description of each record includes:

The name of the program
A man page reference (if appropriate)
The audit event number
The audit event name
The audit record structure

Table B-216 add_drv(1M)

Event Name	Program	Event ID	Event Class	Mask
`AUE_add_drv`	/usr/sbin/add_drv	`9018`	`as`	0x00020000
Format: `header-token` `subject-token` `groups-token` `slabel-token` `return-token` `exec_args-token` (command-line arguments) `text-token` (driver name) `text-token` (base directory) `text-token` (class name) `text-token` (aliases)

Event Name

Program

Event ID

Event Class

Mask

AUE_add_drv

/usr/sbin/add_drv

9018

as

0x00020000

Format:
	header-token
	subject-token
	groups-token
	slabel-token
	return-token
	exec_args-token	(command-line arguments)
	text-token		(driver name)
	text-token		(base directory)
	text-token		(class name)
	text-token		(aliases)

Table B-217 Admin Editor Action - Modify System Files


Event Name	Program	Event ID	Event Class	Mask
`AUE_te_modsysfiles`	trusted editor	`9322`	`ao`	0x00080000
Format: `header-token` `path-token` (filename) `text-token` (changes) `host-token` `return-token` `subject-token` `slabel-token`

Table B-218 allocate(1M) - device success


Event Name	Program	Event ID	Event Class	Mask
`AUE_allocate_succ`	/usr/sbin/allocate	`6200`	`ao`	0x00080000
Format: `header-token` `subject-token` [`slabel-token`] (subject) `newgroups-token` `exit-token`

Table B-219 allocate(1M) - device failure


Event Name	Program	Event ID	Event Class	Mask
`AUE_allocate_fail`	/usr/sbin/allocate	`6201`	`ao`	0x00080000
Format: `header-token` `subject-token` [`slabel-token`] (subject) `newgroups-token` `exit-token`

Table B-220 allocate(1M) - list devices success


Event Name	Program	Event ID	Event Class	Mask
`AUE_listdevice_succ`	/usr/sbin/allocate	`6205`	`ao`	0x00080000
Format: `header-token` `subject-token` [`slabel-token`] (subject) `newgroups-token` `exit-token`

Table B-221 allocate(1M) - list devices failure


Event Name	Program	Event ID	Event Class	Mask
`AUE_listdevice_fail`	/usr/sbin/allocate	`6206`	`ao`	0x00080000
Format: `header-token` `subject-token` [`slabel-token`] (subject) `newgroups-token` `exit-token`

Table B-222 at(1) - create atjob


Event Name	Program	Event ID	Event Class	Mask
`AUE_at_create`	/usr/bin/at	`6144`	`ao`	0x00080000
Format: `header-token` `subject-token` `return-token` `exec_args-token` `text-token` (user name) `text-token` (job queue)

Table B-223 at(1) - delete atjob file (at or atrm)


Event Name	Program	Event ID	Event Class	Mask
`AUE_at_delete`	/usr/bin/at /usr/bin/atrm	`6145`	`ao`	0x00080000
Format: `header-token` `subject-token` `return-token` `exec_args-token` `text-token` (user name) `text-token` (job queue)

Table B-224 at(1) - permission


Event Name	Program	Event ID	Event Class	Mask
`AUE_at_perm`	/usr/bin/at	`6146`	`ao`	0x00080000
Format: `header-token` `subject-token` `[group-token]` `exit-token`

Table B-225 auditd(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_audit`	/usr/sbin/audit	`9016`	`aa`	0x00040000
Format: `header-token` `text-token` ("new audit file" \| "reread audit_control" \| "terminate auditd" \| "unknown option" > `return-token` `subject-token` `slabel-token`

Table B-226 auditwrite(3)


Event Name	Program	Event ID	Event Class	Mask
`AUE_auditwrite`	`auditwrite()`	`9015`	`aa`	0x00040000
Format: `header-token text-token` (error description) `subject-token` `return-token`

Table B-227 automountd(1M) - mismatch


Event Name	Program	Event ID	Event Class	Mask
`AUE_automountd_mismatch`	/usr/lib/fs/autofs/automount	`9034`	`ao`	0x00080000
Format: `header-token` `path-token` (mount dir) `slabel-token` (auto* file slabel) `slabel-token` (remote host template slabel) `text-token` (remote host server) `return-token`

Table B-228 automountd(1M) - mount


Event Name	Program	Event ID	Event Class	Mask
`AUE_automountd_mount`	/usr/lib/fs/autofs/automount	`9033`	`ao`	0x00080000
Format: `header-token` `subject-token` `slabel-token` (subject slabel) `path-token` (mount dir) `return-token` `host-token` (machine name)

Table B-229 chroot(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_chroot`	/usr/sbin/chroot	`9029`	`ao`	0x00080000
Format: `header-token` `subject-token` `groups-token` `slabel-token` `return-token` `exec_args-token` (command-line arguments) `path-token` (new root directory) `path-token` (command to execute)

Table B-230 crontab(1) - crontab created


Event Name	Program	Event ID	Event Class	Mask
`AUE_crontab_create`	/usr/bin/crontab	`6148`	`ao`	0x00080000
Format: `header-token` `subject-token` `return-token` `exec_args-token` `text-token` (user name)

Table B-231 crontab(1) - crontab deleted


Event Name	Program	Event ID	Event Class	Mask
`AUE_crontab_delete`	/usr/bin/crontab	`6149`	`ao`	0x00080000
Format: `header-token` `subject-token` `return-token` `exec_args-token` `text-token` (user name)

Table B-232 crontab(1) - invoke atjob or crontab


Event Name	Program	Event ID	Event Class	Mask
`AUE_cron_invoke`	/usr/bin/crontab	`6147`	`ao`	0x00080000
Format: `header-token` `subject-token` `return-token` `exec_args-token` `text-token` (user name) `text-token` (job type: cron or at) `text-token` (cron command or at job name)

Table B-233 crontab(1) - permission


Event Name	Program	Event ID	Event Class	Mask
`AUE_crontab_perm`	/usr/bin/crontab	`6150`	`ao`	0x00080000
Format: `header-token` `subject-token` `[group-token]` `exit-token`

Table B-234 dbmgr


Event Name	Program	Event ID	Event Class	Mask
`AUE_dm_add`	/opt/SUNWadm/2.3/bin/dbmgr	`9319`	`ao`	0x00080000
`AUE_dm_del`	/opt/SUNWadm/2.3/bin/dbmgr	`9320`
`AUE_dm_mod`		`9321`
Format: `header-token` `text-token` (database info) `text-token` (database type) `text-token` (error message) `return-token` `subject-token` `slabel-token`

Table B-235 deallocate(1M) - device success


Event Name	Program	Event ID	Event Class	Mask
`AUE_deallocate_succ`	/usr/sbin/deallocate	`6202`	`ao`	0x00080000
Format: `header-token` `subject-token` [`slabel-token`] (subject) `newgroups-token` `exit-token`

Table B-236 deallocate(1M) -- device failure


Event Name	Program	Event ID	Event Class	Mask
`AUE_deallocate_fail`	/usr/sbin/deallocate	`6203`	`ao`	0x00080000
Format: `header-token` `subject-token` [`slabel-token`] (subject) `newgroups-token` `exit-token`

Table B-237 dispadmin(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_dispadmin`	/usr/sbin/dispadmin	`9025`	`as`	0x00020000
Format: `header-token` `subject-token` `groups-token` `slabel-token` `return-token` `exec_args-token` (command-line arguments) `text-token` (scheduler class) `path-token` (input file)

Table B-238 dtfile(1) - copy and move


Event Name	Program	Event ID	Event Class	Mask
`AUE_dtfile_copy`	/usr/dt/bin/dtfile	`9037`	`fm`	0x00000008
`AUE_dtfile_move`		`9038`
Format: `header-token` `return-token` `path-token` (target path) `slabel-token` (slabel of target) `path-token` (source path) `slabel-token` (slabel of source) `host-token`

Table B-239 eeprom(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_eeprom`	/usr/sbin/eeprom	`9032`	`as`	0x00020000
Format: `header-token` `return-token` `path-token` (prom device) `text-token` (variable=old value) `text-token` (variable=new value)

Table B-240 fuser(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_fuser`	/usr/sbin/fuser	`9031`	`ao`	0x00080000
Format: `header-token` `subject-token` `groups-token` `slabel-token` `return-token` `exec_args-token` (command-line arguments) `path-token` (file name) `arg-token` (1, "PID", process-id)

Table B-241 groupmgr


Event Name	Program	Event ID	Event Class	Mask
`AUE_gm_add_grp`	/opt/SUNWadm/2.3/bin/groupmgr	`9307`	`ao`	0x00080000
`AUE_gm_del_grp`	/opt/SUNWadm/2.3/bin/groupmgr	`9308`	`ao`	0x00080000
`AUE_gm_mod_grp`		`9309`	`ao`	0x00080000
Format: `header-token` `text-token` (group info) `text-token` (error message) `return-token` `subject-token` `slabel-token`

Table B-242 halt(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_halt_solaris`	/usr/sbin/halt	`6160`	`ss`	0x00010000
Format: `header-token` `subject-token` `return-token`

Table B-243 hostmgr


Event Name	Program	Event ID	Event Class	Mask
`AUE_hm_add_host`	/opt/SUNWadm/2.3/bin/hostmgr	`9310`	`ao`	0x00080000
`AUE_hm_del_host`	/opt/SUNWadm/2.3/bin/hostmgr	`9311`
`AUE_hm_mod_host`		`9312`
`AUE_hm_set_def`		`9313`
Format: `header-token` `text-token` (host info) `text-token` (error message) `return-token` `subject-token` `slabel-token`

Table B-244 inetd(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_inetd_connect`	/usr/sbin/inetd	`6151`	`na`	0x00000400
Format: `header-token` `subject-token` `text-token` (service name) `ip-address-token` `ip-port-token` `return-token`

Table B-245 in.ftpd(1M) - ftp access


Event Name	Program	Event ID	Event Class	Mask
`AUE_ftpd`	/usr/sbin/in.ftpd	`6165`	`lo`	0x00001000
Format: `header-token` `subject-token` `text-token` (error message, failure only) `return-token`

Table B-246 installf(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_installf`	/usr/sbin/installf	`9042`	`as`	0x00020000
Format: `header-token` `return-token` `argument-token` (package name) `subject-token` `slabel-token`

Table B-247 login(1) -- local


Event Name	Program	Event ID	Event Class	Mask
`AUE_login`	/usr/bin/login	`6152`	`lo`	0x00001000
Format: `header-token` `text-token` `text-token` (message - success or failure) `subject-token` `return-token`

Table B-248 login(1) -- rlogin


Event Name	Program	Event ID	Event Class	Mask
`AUE_rlogin`	/usr/bin/login	`6155`	`lo`	0x00001000
Format: `header-token` `subject-token` `text-token` (error message) `return-token`

Table B-249 login(1) -- telnet


Event Name	Program	Event ID	Event Class	Mask
`AUE_telnet`	/usr/bin/login	`6154`	`lo`	0x00001000
Format: `header-token` `subject-token` `text-token` (error message) `return-token`

Table B-250 logout(1)


Event Name	Program	Event ID	Event Class	Mask
`AUE_logout`	/usr/bin/login	`6153`	`lo`	0x00001000
Format: `header-token` `subject-token` `text-token` `return-token`

Table B-251 lpadmin(1M) - authorization


Event Name	Program	Event ID	Event Class	Mask
`AUE_uauth`	/usr/lib/lpadmin	`9017`	`ao`	0x00080000
Format: `header-token` `text-token` (authorization used) `return-token` `text-token` (lpadmin command line) `subject-token` `slabel-token` `host-token`

Table B-252 lpsched(1M) - authorization

Event Name	Program	Event ID	Event Class	Mask
`AUE_uauth`	/usr/lib/lpsched	`9017`	`ao`	0x00080000
Format: `header-token` `text-token` (" print without banners \| print without labels \|print a PostScript file") `return-token` `text-token` (hostname/jobnumber-filenumber) `slabel-token` (label of print job) `subject-token` `slabel-token` `host-token`

Event Name

Program

Event ID

Event Class

Mask

AUE_uauth

/usr/lib/lpsched

9017

ao

0x00080000

Format:
	header-token
	text-token		(" print without banners | print without labels |print a PostScript file")
	return-token		
	text-token		(hostname/jobnumber-filenumber)
	slabel-token	(label of print job)
	subject-token	
	slabel-token	
	host-token

Table B-253 lpsched(1M) - privilege


Event Name	Program	Event ID	Event Class	Mask
`AUE_lp_cancel`	/usr/lib/lpsched	`9044`	`ao`	0x00080000
`AUE_lp_status`	/usr/lib/lpsched	`9045`
Format: `header-token` `return-token` `privilege-token` `text-token` (hostname/jobnumber-filenumber) `slabel-token` (print job label) `subject-token` `slabel-token` `host-token` (error message)

Table B-254 modload(1M), modunload(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_modload`	/usr/sbin/modload	`9020`	`as`	0x00020000
`AUE_modunload`	/usr/sbin/modunload	`9021`
Format: `header-token` `subject-token` `groups-token` `slabel-token` `return-token` `exec_args-token` (command-line arguments) `text-token` (module pathname)

Table B-255 mountd(1M) - NFS mount

Event Name	Program	Event ID	Event Class	Mask
`AUE_mountd_mount`	/usr/lib/nfs/mountd	`6156`	`na`	0x00000400
Format: `header-token` `argument-token` `slabel-token` (subject slabel) `text-token` (remote client hostname) `path-token` (mount dir) `slabel-token` (slabel of the directory) `text-token` (error message, failure only) `attribute-token` `subject-token` `return-token`

Event Name

Program

Event ID

Event Class

Mask

AUE_mountd_mount

/usr/lib/nfs/mountd

6156

na

0x00000400

Format:
	header-token
	argument-token
	slabel-token	(subject slabel)
	text-token	(remote client hostname)
	path-token	(mount dir)
	slabel-token	(slabel of the directory)
	text-token	(error message, failure only)
	attribute-token
	subject-token
	return-token

Table B-256 mountd(1M) - NFS unmount

Event Name	Program	Event ID	Event Class	Mask
`AUE_mountd_umount`	/usr/lib/nfs/mountd	`6157`	`na`	0x00000400
Format: `header-token` `slabel-token` (subject slabel) `text-token` (remote client hostname) `path-token` (mount dir) `slabel-token` (slabel of the directory) `text-token` (error message, failure only) `attribute-token` `subject-token` `return-token`

Event Name

Program

Event ID

Event Class

Mask

AUE_mountd_umount

/usr/lib/nfs/mountd

6157

na

0x00000400

Format:
	header-token
	slabel-token	(subject slabel)
	text-token	(remote client hostname)
	path-token	(mount dir)
	slabel-token	(slabel of the directory)
	text-token	(error message, failure only)
	attribute-token
	subject-token
	return-token

Table B-257 passwd(1)


Event Name	Program	Event ID	Event Class	Mask
`AUE_passwoeoed`	/usr/bin/passwd	`6163`	`lo`	0x00001000
Format: `header-token` `subject-token` `text-token` (error message) `return-token`

Table B-258 pbind(1M)

Event Name	Program	Event ID	Event Class	Mask
`AUE_pbind`	/usr/sbin/pbind	`9026`	`as`	0x00020000
Format: `header-token` `subject-token` `groups-token` `slabel-token` `return-token` `exec_args-token` (command-line arguments) `text-token` (action: "BIND" \| "UNBIND") `arg-token` (1, "CPU", processor id) `arg-token` (2, "PID", process-id)

Event Name

Program

Event ID

Event Class

Mask

AUE_pbind

/usr/sbin/pbind

9026

as

0x00020000

Format:
	header-token
	subject-token
	groups-token
	slabel-token
	return-token
	exec_args-token	(command-line arguments)
	text-token	(action: "BIND" | "UNBIND")
	arg-token		(1, "CPU", processor id)
	arg-token		(2, "PID", process-id)

Table B-259 pfsh(1M)

Event Names	Program	Event IDs	Event Class	Mask
`AUE_pfsh_trusted_priv AUE_pfsh_trusted_nopriv AUE_pfsh_priv`	/usr/bin/pfsh	`9007 9008 9009`	`ao`	0x00080000
`AUE_pfsh_nopriv`	/usr/bin/pfsh	`9010`	`ap`	0x00004000
Format: `header-token` `path-token` (of the executable) `exec_args-token` `path-token` (of current directory) `privilege-token` `return-token` `exec_env-token` (if AUDIT_ARGE is on) `subject-token` `slabel-token`

Event Names

Program

Event IDs

Event Class

Mask

AUE_pfsh_trusted_priv AUE_pfsh_trusted_nopriv AUE_pfsh_priv

/usr/bin/pfsh

9007 9008 9009

ao

0x00080000

AUE_pfsh_nopriv

/usr/bin/pfsh

9010

ap

0x00004000

Format:
	header-token
	path-token		(of the executable)
	exec_args-token
	path-token		(of current directory)
	privilege-token
	return-token
	exec_env-token		(if AUDIT_ARGE is on)
	subject-token
	slabel-token

Table B-260 pkgadd(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_pkginstall`	/usr/sbin/pkgadd	`9040`	`as`	0x00020000
Format: `header-token` `return-token` `argument-token` (package name) `subject-token` `slabel-token`

Table B-261 pkgrm(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_pkgremove`	/usr/sbin/pkgrm	`9041`	`as`	0x00020000
Format: `header-token` `return-token` `argument-token` (package name) `subject-token` `slabel-token`

Table B-262 printmgr


Event Name	Program	Event ID	Event Class	Mask
`AUE_pm_add_prn`	/opt/SUNWadm/2.3/bin/printmgr	`9316`	`ao`	0x00080000
`AUE_pm_del_prn`	/opt/SUNWadm/2.3/bin/printmgr	`9318`	`ao`	0x00080000
`AUE_pm_mod_prn`		`9317`	`ao`	0x00080000
Format: `header-token` `text-token` (printer info) `text-token` (error message) `return-token` `subject-token` `slabel-token`

Table B-263 profmgr - add profile


Event Name	Program	Event ID	Event Class	Mask
`AUE_pm_add_prof`	/opt/SUNWadm/2.3/bin/profmgr	`9306`	`ao`	0x00080000
Format: `header-token` `text-token` (new profile info) `text-token` (error message) `return-token` `subject-token` `slabel-token`

Table B-264 profmgr - delete profile


Event Name	Program	Event ID	Event Class	Mask
`AUE_pm_del_prof`	/opt/SUNWadm/2.3/bin/profmgr	`9304`	`ao`	0x00080000
Format: `header-token` `text-token` (profile info) `text-token` (error message) `return-token` `subject-token` `slabel-token`

Table B-265 profmgr - modify profile


Event Name	Program	Event ID	Event Class	Mask
`AUE_pm_mod_prof`	/opt/SUNWadm/2.3/bin/profmgr	`9305`	`ao`	0x00080000
Format: `header-token` `text-token` (old profile info) `text-token` (new profile info) `text-token` (error message) `return-token` `subject-token` `slabel-token`

Table B-266 psradm(1m)


Event Name	Program	Event ID	Event Class	Mask
`AUE_psradm`	/usr/sbin/psradm	`9027`	`ps`	0x00100000
Format: `header-token` `subject-token` `groups-token` `slabel-token` `return-token` `exec_args-token` (command-line arguments) `text-token` (action: "ON" \| "OFF") `arg-token` (1, "PID", processor id)

Table B-267 reboot(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_reboot_solaris`	/usr/sbin/reboot	`6161`	`ss`	0x00010000
Format: `header-token` `subject-token` `return-token`

Table B-268 removef(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_removef`	/usr/sbin/removef	`9043`	`as`	0x00020000
Format: `header-token` `return-token` `argument-token` (package name) `subject-token` `slabel-token`

Table B-269 rpc.rexd(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_rexd`	/usr/sbin/rpc.rexd	`6164`	`lo`	0x00001000
Format: `header-token` `subject-token` `text-token` (error message, failure only) `text-token` (hostname) `text-token` (username) `text-token` (command to be executed) `exit-token`

Table B-270 in.rexecd(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_rexecd`	/usr/sbin/in.rexecd	`6162`	`lo`	0x00001000
Format: `header-token` `subject-token` `text-token` (error message, failure only) `text-token` (hostname) `text-token` (username) `text-token` (command to be executed) `exit-token`

Table B-271 in.rshd(1M) - rsh access


Event Name	Program	Event ID	Event Class	Mask
`AUE_rshd`	/usr/sbin/in.rshd	`6158`	`lo`	0x00001000
Format: `header-token` `subject-token` `text-token` (command string) `text-token` (local user) `text-token` (remote user) `return-token`

Table B-272 rem_drv(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_rem_drv`	/usr/sbin/rem_drv	`9019`	`as`	0x00020000
Format: `header-token` `subject-token` `groups-token` `slabel-token` `return-token` `exec_args-token` (command-line arguments) `text-token` (driver name) [`text-token`] (base directory)

Table B-273 init(1M) - run level change


Event Name	Program	Event ID	Event Class	Mask
`AUE_run_level_change`	/usr/sbin/init	`9024`	`ss`	0x00010000
Format: `header-token` `text-token` (new run level) `subject-token` `slabel-token` (if slabel policy on) `return-token`

Table B-274 Selection Manager Transfer


Event Name	Program	Event ID	Event Class	Mask
`AUE_sel_mgr_xfer`		`9039`	`ax`	0x00002000
Format: `header-token` `subject-token` `slabel-token` `return-token`

Table B-275 sendmail(1M)

Event Name

Program

Event ID

Event Class

Mask

AUE_sendmail_deliver AUE_sendmail_defer

/usr/lib/sendmail

9013 9014

ao

0x00080000

Format:
	header-token
	text-token		(message about status)
	text-token		(to)
	text-token	(message ID)
	text-token		(from)
	text-token		(from host)
	text-token		(to user)
	text-token		(to host)
	return-token	
	slabel-token

Table B-276 sendmail(1M) - upgrade


Event Name	Program	Event ID	Event Class	Mask
`AUE_sendmail_upgrade`	/usr/lib/sendmail	`9012`	`ao`	0x00080000
Format: `header-token` `text-token` (message ID) `slabel-token` (old label) `slabel-token` (new label) `subject-token` `slabel-token`

Table B-277 serialmgr


Event Name	Program	Event ID	Event Class	Mask
`AUE_sm_del_ser`	/opt/SUNWadm/2.3/bin/serialmgr	`9315`	`ao`	0x00080000
`AUE_sm_mod_ser`	/opt/SUNWadm/2.3/bin/serialmgr	`9314`
Format: `header-token` `text-token` (port info) `text-token` (error message) `return-token` `subject-token` `slabel-token`

Table B-278 setuname(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_setuname`	/usr/bin/setuname	`9022`	`as`	0x00020000
Format: `header-token` `subject-token` `groups-token` `slabel-token` `return-token` `exec_args-token`(command-line arguments) `text-token` (action: "ADD" \| "DELETE") `path-token` (swapname)

Table B-279 share(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_EXPORTFS`	/usr/lib/fs.d/nfs/share	61	`ao`	0x00080000
Format: `header-token` `subject-token` `slabel-token` (subject slabel) `path-token` (export directory) `slabel-token` (slabel of the directory) `text-token` (export options) `return-token`

Table B-280 Workspace SL Change


Event Name	Program	Event ID	Event Class	Mask
`AUE_sl_change`		`9035`	`ap`	0x00004000
Format: `header-token` `subject-token` `slabel-token` (original SL) `slabel-token` (new SL) `return-token` `host-token`

Table B-281 su(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_su`	/usr/bin/su	`6159`	`lo`	0x00001000
Format: `header-token` `subject-token` `text-token` (error message) `return-token`

Table B-282 swap(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_swap`	/usr/sbin/swap	`9030`	`as`	0x00020000
Format: `header-token` `subject-token` `groups-token` `slabel-token` `return-token` `exec_args-token` `text-token` (new node name \| "none") `text-token` (new systemname \| "none")

Table B-283 uadmin(1M)

Event Name

Program

Event ID

Event Class

Mask

AUE_uadmin_cmd

/usr/sbin/uadmin

9023

ss

0x00010000

Format:
	header-token
	subject-token
	groups-token
	slabel-token
	return-token
	exec_args-token	(command-line arguments)
	argument-token	(1, "cmd", command code)
	argument-token	(2, "fcn", function code)

Table B-284 uauth


Event Name	Program	Event ID	Event Class	Mask
`AUE_uauth`	use of authorization	`9017`	`ao`	0x00080000
(See Table B-252 for use of authorization with printing) Format: `header-token` `text-token` (user name) `text-token` (authorization) `subject-token` `return-token`

Table B-285 usermgr


Event Name	Program	Event ID	Event Class	Mask
`AUE_um_add_user`	/opt/SUNWadm/2.3/bin/usermgr	`9302`	`ao`	0x00080000
`AUE_um_del_user`	/opt/SUNWadm/2.3/bin/usermgr	`9301`
`AUE_um_mod_user`		`9300`
`AUE_um_set_def`		`9303`
Format: `header-token` `text-token` (user info) `text-token` (error message) `return-token` `subject-token` `slabel-token`

Table B-286 uname(1)


Event Name	Program	Event ID	Event Class	Mask
`AUE_uname_set`	/usr/bin/uname	`9024`	`as`	0x00020000
Format: `header-token` `subject-token` `groups-token` `slabel-token` `return-token` `exec_args-token` (command-line arguments) `text-token` (new node name)

Table B-287 unshare(1M)


Event Name	Program	Event ID	Event Class	Mask
`AUE_exportfs`	/usr/lib/fs.d/nfs/share		`na`	0x00000400
Format: `header-token` `subject-token` `slabel-token` (subject slabel) `path-token` (export directory) `return-token`