return Token

A return token gives the return status of the system call and the process return value. This token is always returned as part of kernel-generated audit records for system calls. The fields are:

• A token ID

• The system call error status

• The system call return value

A return token is displayed by praudit as follows:

return,success,0