attr Token

The attr token contains file attribute information from the kernel's internal representation of a file or folder. This token usually accompanies a path token and is produced during path searches. In the event of a path-search error, this token is not included as part of the audit record since the file attribute information is not available. The fields are:

• A token ID

• The file access mode and type

• The owner user ID

• The owner group ID

• The file system ID

• The inode ID

• The device ID that the file might represent

See the statvfs(2) man page for further information about the file system ID and the device ID. The following figure shows the token format.

Figure B-5 attr Token Format

An attr token is displayed by praudit as follows:

attribute,100555,root,root,1805,13871,-4288