return Token

The return token contains the return status of the system call (u_error) and the process return value (u_rval1). The token indicates exit status and other return values in application auditing. This token is always returned as part of kernel-generated audit records for system calls. The fields are:

• A token ID

• The system call error status

• The system call return value

The following figure shows the token format.

Figure B-26 return Token Format

A return token is displayed by praudit as follows:

return,failure: No such file or directory,-1