header Token

The header token is special in that it marks the beginning of an audit record and combines with the trailer token to bracket all the other tokens in the record. The fields are:

• A token ID

• The record length in bytes, including the header and trailer tokens

• An audit record structure version number

• An event ID identifying the type of audit event

• An event ID modifier with descriptive information about the event type

• The time and date the record was created

The following figure shows a header token.

Figure B-12 header Token Format

The event modifier field has the following flags defined:

A header token is displayed by praudit as follows:

header,449,3,pfsh(1M),,Mon May