Declaration and Argument Types

The auditwrite(3TSOL) routine generates and logs third-party audit events.

int auditwrite(..., AW_END);

This library routine takes a variable number of arguments of the following three kinds. Refer to the auditwrite(3TSOL) man page for a complete listing of argument commands and their meaning. The code examples in this chapter use many of the possible argument commands.

• Control commands - control the behavior of the auditwrite(3TSOL) routine by, for example, directing the auditwrite() routine to add information to a partially built audit record (AW_APPEND) or send a complete audit record to the audit trail (AW_WRITE). The parameter list must have exactly one control command.

• Token commands - are typically specified when the control command is either AW_WRITE or AW_APPEND. Token commands describe the attributes that make up an audit record such as the event that occurred (AW_EVENT), a text message (AW_TEXT), or the path name leading to a file system object where the event occurred (AW_PATH). An attribute command is always followed by one or more value parameters that supply values of the type indicated by the attribute parameter. The control command and attribute commands can appear in any order in the parameter list.

• Terminator command - AW_END is always positioned at the end of the parameter list to tell the auditwrite(3TSOL) routine to stop parsing.