The attribute token contains information from the file vnode.
The attribute token has seven fields:
A token ID that identifies this token as an attribute token
The file access mode and type
The owner user ID
The owner group ID
The file system ID
The node ID
The device ID that the file might represent
For further information about the file system ID and the device ID, see the statvfs(2) man page.
The attribute token usually accompanies a path token. The attribute token is produced during path searches. If a path-search error occurs, there is no vnode available to obtain the necessary file information. Therefore, the attribute token is not included as part of the audit record. The praudit -x command shows the fields of the attribute token:
<attribute mode="100644" uid="adm" gid="adm" fsid="136" nodeid="2040" device="0"/>