Trusted Solaris Audit Administration

X Server Protocol Audit Records

These audit records are created by X windows calls and use of the X server. The records are sorted alphabetically by protocol; where possible, records with identical structure are listed together. The description of each record includes:

The name of the protocol
The audit event number
The audit event name
The audit record structure

Table B–190 XClientConnect


Event Name	Message	Event ID	Event Class	Mask
`AUE_ClientConnect`	Client connection to Xserver	`9101`	`xl`	0x08000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `xclient-token` `inaddr-token` (IP address of client) `iport-token` (port on server) `return-token`

Table B–191 XClientDisconnect


Event Name	Message	Event ID	Event Class	Mask
`AUE_ClientDisconnect`	Client logout from Xserver	`9102`	`xl`	0x08000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `xclient-token` `return-token`

Table B–192 X Server Protocols - window operations


Event Name	Message	Event ID	Event Class	Mask
`AUE_ChangeSaveSet`	Change the saved set	`9108`	`xp`	0x10000000
`AUE_ChangeWindowAttributes`	Change window attributes	`9104`
`AUE_CirculateWindow`	Circulate the window	`9115`
`AUE_ConfigureWindow`	Configure the window	`9114`
`AUE_CreateWindow`	Create window	`9103`
`AUE_DestroySubwindows`	Destroy subwindows	`9107`
`AUE_DestroyWindow`	Destroy window	`9106`
`AUE_GetGeometry`	Get window geometry	`9116`
`AUE_GetWindowAttributes`	Get window attributes	`9105`
`AUE_MapSubwindows`	Map the subwindows	`9111`
`AUE_MapWindow`	Map the window	`9110`
`AUE_QueryTree`	Query window tree	`9117`
`AUE_ReparentWindow`	Reparent the window	`9109`
`AUE_UnmapSubwindows`	Unmap the subwindows	`9113`
`AUE_UnmapWindow`	Unmap the window	`9112`
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xwindow-token` `return-token`

Table B–193 X Server Protocols - window properties


Event Name	Message	Event ID	Event Class	Mask
`AUE_ChangeProperty`	Change window property	`9120`	`xc`	0x20000000
`AUE_DeleteProperty`	Delete window property	`9121`	`xc`	0x20000000
`AUE_GetProperty`	Get window property	`9122`	`xp`	0x10000000
`AUE_ListProperties`	List window properties	`9123`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xwindow-token` `xproperty-token` `return-token`

Table B–194 XGetAtomName, XInternAtom


Event Name	Message	Event ID	Event Class	Mask
`AUE_GetAtomName`	Get atom name	`9119`	`xs`	0x80000000
`AUE_InternAtom`	Fetch atom	`9118`	`xs`	0x80000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xatom-token` (atom string) `return-token`

Table B–195 XConvertSelection, XGetSelectionOwner, XSetSelectionOwner


Event Name	Message	Event ID	Event Class	Mask
`AUE_ConvertSelection`	Convert selection	`9126`	`xs`	0x80000000
`AUE_GetSelectionOwner`	Get selection owner	`9125`	`xs`	0x80000000
`AUE_SetSelectionOwner`	Set selection owner	`9124`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xclient-token` `return-token`

Table B–196 XGrabButton

Event Name	Message	Event ID	Event Class	Mask
`AUE_GrabButton`	Grab window button	`9130`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xwindow-token` (grabbing window id) `[xwindow-token]` (current device focus) `xcursor-token` `return-token`

Event Name

Message

Event ID

Event Class

Mask

AUE_GrabButton

Grab window button

9130

xp

0x10000000

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]  (if privilege used or required)
	xwindow-token  (grabbing window id)
	[xwindow-token]  (current device focus)
	xcursor-token
	return-token

Table B–197 XGrabPointer, XUngrabPointer, XUngrabButton


Event Name	Message	Event ID	Event Class	Mask
`AUE_GrabPointer`	Grab pointer	`9128`	`xs`	0x80000000
`AUE_UngrabButton`	Release window button	`9131`	`xs`	0x80000000
`AUE_UngrabPointer`	Release pointer	`9129`	`xs`	0x80000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xwindow-token` (grabbing window id) `[xwindow-token]` (current device focus) `xcursor-token` `return-token`

Table B–198 XChangeActivePointerGrab


Event Name	Message	Event ID	Event Class	Mask
`AUE_ChangeActivePointerGrab`	Change active pointer grab	`9132`	`xs`	0x80000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xcursor-token` `return-token`

Table B–199 XGrabKey, XUngrabKeyboard


Event Name	Message	Event ID	Event Class	Mask
`AUE_GrabKey`	Grab key	`9135`	`xs`	0x80000000
`AUE_UngrabKeyboard`	Release keyboard	`9134`	`xs`	0x80000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xwindow-token` `return-token`

Table B–200 XGrabKeyboard, XUngrabKey


Event Name	Message	Event ID	Event Class	Mask
`AUE_GrabKeyboard`	Grab keyboard	`9133`	`xp`	0x10000000
`AUE_UngrabKey`	Release key	`9135`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xwindow-token` `return-token`

Table B–201 XGrabServer, XUngrabServer


Event Name	Message	Event ID	Event Class	Mask
`AUE_GrabServer`	Grab the server	`9137`	`xa`	0x40000000
`AUE_UngrabServer`	Release the server	`9138`	`xa`	0x40000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xclient-token` `return-token`

Table B–202 XQueryPointer

Event Name	Message	Event ID	Event Class	Mask
`AUE_QueryPointer`	Query pointer	`9139`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xwindow-token` (querying window id) `[xwindow-token]` (pointer's window id) `return-token`

Event Name

Message

Event ID

Event Class

Mask

AUE_QueryPointer

Query pointer

9139

xp

0x10000000

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]  (if privilege used or required)
	xwindow-token  (querying window id)
	[xwindow-token] (pointer's window id)
	return-token

Table B–203 XGetMotionEvents, XSendEvent


Event Name	Message	Event ID	Event Class	Mask
`AUE_GetMotionEvents`	Get motion events	`9140`	`xp`	0x10000000
`AUE_SendEvent`	Send window event	`9127`	`xs`	0x80000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xwindow-token` `return-token`

Table B–204 XTranslateCoords, XWarpPointer

Event Name	Message	Event ID	Event Class	Mask
`AUE_TranslateCoords`	Translate coordinates	`9141`	`xp`	0x10000000
`AUE_WarpPointer`	Warp the pointer	`9142`	`xs`	0x80000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xwindow-token` (source window id) `[xwindow-token]` (destination window id) `return-token`

Event Name

Message

Event ID

Event Class

Mask

AUE_TranslateCoords

Translate coordinates

9141

xp

0x10000000

AUE_WarpPointer

Warp the pointer

9142

xs

0x80000000

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]      (if privilege used or required)
	xwindow-token (source window id)
	[xwindow-token] (destination window id)
	return-token

Table B–205 XGetInputFocus, XSetInputFocus


Event Name	Message	Event ID	Event Class	Mask
`AUE_GetInputFocus`	Get input focus	`9144`	`xs`	0x80000000
`AUE_SetInputFocus`	Set input focus	`9143`	`xs`	0x80000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xwindow-token` `return-token`

Table B–206 XQueryKeymap


Event Name	Message	Event ID	Event Class	Mask
`AUE_QueryKeymap`	Query keymap	`9145`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xclient-token` `return-token`

Table B–207 XSetFontPath


Event Name	Message	Event ID	Event Class	Mask
`AUE_SetFontPath`	Set font path	`9146`	`xa`	0x40000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `[xwindow-token]` `xfont-token` `return-token`

Table B–208 XChangeGC


Event Name	Message	Event ID	Event Class	Mask
`AUE_ChangeGC`	Change graphical context	`9148`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xfont-token` `xpixmap-token` `xgc-token` `return-token`

Table B–209 XCopyGC


Event Name	Message	Event ID	Event Class	Mask
`AUE_CopyGC`	Copy graphical context	`9149`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xgc-token` (source gc ID) `[xgc-token]` (destination gc ID) `return-token`

Table B–210 XFreeGC, XSetClipRectangles, XSetDashes


Event Name	Message	Event ID	Event Class	Mask
`AUE_FreeGC`	Free graphical context	`9152`	`xc`	0x20000000
`AUE_SetClipRectangles`	Set clip rectangles	`9151`	`xp`	0x10000000
`AUE_SetDashes`	Set dashes	`9150`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `[xpixmap-token]` `[xfont-token]` `[xgc-token]` `return-token`

Table B–211 XClearArea


Event Name	Message	Event ID	Event Class	Mask
`AUE_ClearArea`	Clear area	`9153`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xwindow-token` `return-token`

Table B–212 XCopyArea, XCopyPlane

Event Name	Message	Event ID	Event Class	Mask
`AUE_CopyArea`	Copy area	`9154`	`xs`	0x80000000
`AUE_CopyPlane`	Copy plane	`9155`	`xs`	0x80000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xpixmap-token` (source pixmap ID) `xpixmap-token` (destination pixmap ID) `xgc-token` `return-token`

Event Name

Message

Event ID

Event Class

Mask

AUE_CopyArea

Copy area

9154

xs

0x80000000

AUE_CopyPlane

Copy plane

9155

xs

0x80000000

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]  (if privilege used or required)
	xpixmap-token  (source pixmap ID)
	xpixmap-token  (destination pixmap ID)
	xgc-token
	return-token

Table B–213 XFillPolygon, XPolyArc, XPolyFillArc, XPolyFillRectangle, XPolyLine, XPolyPoint, XPolyRectangle, XPolySegment


Event Name	Message	Event ID	Event Class	Mask
`AUE_FillPolygon`	Fill polygon	`9161`	`xp`	0x10000000
`AUE_PolyArc`	Polyarc	`9160`	`xp`	0x10000000
`AUE_PolyFillArc`	Fill polyarc	`9163`	`xp`	0x10000000
`AUE_PolyFillRectangle`	Fill polyrectangle	`9162`	`xp`	0x10000000
`AUE_PolyLine`	Polyline	`9157`	`xp`	0x10000000
`AUE_PolyPoint`	Polypoint	`9156`	`xp`	0x10000000
`AUE_PolyRectangle`	Polyrectangle	`9159`	`xs`	0x80000000
`AUE_PolySegment`	Polysegment	`9158`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xwindow-token` `xpixmap-token` `xgc-token` `return-token`

Table B–214 XGetImage, XImageText8, XImageText16, XPolyText8, XPolyText16, XPutImage


Event Name	Message	Event ID	Event Class	Mask
`AUE_GetImage`	Get image	`9165`	`xs`	0x80000000
`AUE_ImageText8`	Imagetext (8-bit)	`9168`	`xp`	0x10000000
`AUE_ImageText16`	Imagetext (16-bit)	`9169`	`xp`	0x10000000
`AUE_PolyText8`	Polytext (8-bit)	`9166`	`xp`	0x10000000
`AUE_PolyText16`	Polytext (16-bit)	`9167`	`xp`	0x10000000
`AUE_PutImage`	Put image	`9164`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xwindow-token` `xpixmap-token` `xgc-token` `return-token`

Table B–215 XCreateColormap


Event Name	Message	Event ID	Event Class	Mask
`AUE_CreateColormap`	Create colormap	`9170`	`xc`	0x20000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xwindow-token` `return-token`

Table B–216 XAllocColor, XAllocColorCells, XAllocColorPlanes, XAllocNamedColor, XFreeColors


Event Name	Message	Event ID	Event Class	Mask
`AUE_AllocColor`	Allocate color	`9176`	`xc`	0x20000000
`AUE_AllocColorCells`	Allocate color cells	`9178`
`AUE_AllocColorPlanes`	Allocate color planes	`9179`
`AUE_AllocNamedColor`	Allocate named color	`9177`
`AUE_FreeColors`	Free colors	`9180`
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xcolormap-token` `return-token`

Table B–217 XCopyColormapAndFree, XFreeColormap, XInstallColormap, XListInstalledColormap, XUninstallColormap


Event Name	Message	Event ID	Event Class	Mask
`AUE_CopyColormapAndFree`	Copy and free colormap	`9172`	`xp`	0x10000000
`AUE_FreeColormap`	Free colormap	`9171`	`xp`	0x10000000
`AUE_InstallColormap`	Install colormap	`9173`	`xa`	0x40000000
`AUE_ListInstalledColormap`	List installed colormap	`9175`	`xs`	0x80000000
`AUE_UninstallColormap`	Uninstall colormap	`9174`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xcolormap-token` `return-token`

Table B–218 XLookupColor, XQueryColors, XStoreColors, XStoreNamedColor


Event Name	Message	Event ID	Event Class	Mask
`AUE_LookupColor`	Look up colors	`9184`	`xp`	0x10000000
`AUE_QueryColors`	Query colors	`9183`	`xp`	0x10000000
`AUE_StoreColors`	Store colors	`9181`	`xp`	0x10000000
`AUE_StoreNamedColor`	Store named colors	`9182`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xcolormap-token` `return-token`

Table B–219 XCreateCursor

Event Name	Message	Event ID	Event Class	Mask
`AUE_CreateCursor`	Create cursor	`9185`	`xc`	0x20000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xpixmap-token` (source pixmap ID) `xpixmap-token` (mask pixmap ID) `xcursor-token` `return-token`

Event Name

Message

Event ID

Event Class

Mask

AUE_CreateCursor

Create cursor

9185

xc

0x20000000

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]  (if privilege used or required)
	xpixmap-token  (source pixmap ID)
	xpixmap-token  (mask pixmap ID)
	xcursor-token
	return-token

Table B–220 XCreateGlyphCursor

Event Name	Message	Event ID	Event Class	Mask
`AUE_CreateGlyphCursor`	Create glyph cursor	`9186`	`xc`	0x20000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xfont-token` (source font ID) `xfont-token` (mask font ID) `xcursor-token` `return-token`

Event Name

Message

Event ID

Event Class

Mask

AUE_CreateGlyphCursor

Create glyph cursor

9186

xc

0x20000000

Format:
	header-token
	subject-token
	newgroups-token
	slabel-token
	[priv-token]  (if privilege used or required)
	xfont-token  (source font ID)
	xfont-token  (mask font ID)
	xcursor-token
	return-token

Table B–221 XFreeCursor, XRecolorCursor


Event Name	Message	Event ID	Event Class	Mask
`AUE_FreeCursor`	Free cursor	`9187`	`xc`	0x20000000
`AUE_RecolorCursor`	Recolor cursor	`9188`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xcursor-token` `return-token`

Table B–222 XFreePixmap


Event Name	Message	Event ID	Event Class	Mask
`AUE_FreePixmap`	Free pixmap	`9147`	`xc`	0x20000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xpixmap-token` `return-token`

Table B–223 XBell, XChangeKeyboardControl, XChangeKeyboardMapping, XChangePointerControl


Event Name	Message	Event ID	Event Class	Mask
`AUE_Bell`	Bell	`9193`	`xs`	0x80000000
`AUE_ChangeKeyboardControl`	Change keyboard control	`9190`
`AUE_ChangeKeyboardMapping`	Change keyboard mapping	`9189`
`AUE_ChangePointerControl`	Change pointer control	`9192`
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xclient-token` `return-token`

Table B–224 XForceScreenSaver, XSetScreenSaver


Event Name	Message	Event ID	Event Class	Mask
`AUE_ForceScreenSaver`	Cover screen	`9199`	`xp`	0x10000000
`AUE_SetScreenSaver`	Set screensaver	`9193`
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xclient-token` `return-token`

Table B–225 XSetCloseDownMode


Event Name	Message	Event ID	Event Class	Mask
`AUE_SetCloseDownMode`	Set closedown mode	`9196`	`xs`	0x80000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xclient-token` `return-token`

Table B–226 XChangeHosts, XKillClient, XSetAccessControl


Event Name	Message	Event ID	Event Class	Mask
`AUE_ChangeHosts`	Change hosts	`9194`	`xa`	0x40000000
`AUE_KillClient`	Kill client	`9197`	`xc`	0x20000000
`AUE_SetAccessControl`	Set access control	`9195`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xclient-token` `return-token`

Table B–227 XRotateProperties


Event Name	Message	Event ID	Event Class	Mask
`AUE_RotateProperties`	Rotate properties	`9198`	`xp`	0x10000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xwindow-token` `xproperty-token` `return-token`

Table B–228 XSetModifierMapping, XSetPointerMapping


Event Name	Message	Event ID	Event Class	Mask
`AUE_SetModifierMapping`	Set modifier mapping	`9201`	`xs`	0x80000000
`AUE_SetPointerMapping`	Set pointer mapping	`9200`	`xs`	0x80000000
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xclient-token` `return-token`

Table B–229 X Server Extensions


Event Name	Message	Event ID	Event Class	Mask
`AUE_XExtensions`	X extension protocols	`9202`	`xp`
Format: `header-token` `subject-token` `newgroups-token` `slabel-token` `[priv-token]` (if privilege used or required) `xclient-token` `return-token`

The AUE_XExtensions audit record format is used when auditing extensions to the X11 library, such as XTSOLMakeTPWindow.