Trusted Solaris Developer's Guide

Using the Save Area

You can turn on a save area (AW_SAVERD) and store tokens there to be prepended to records before they are written to the audit trail. Getting and using a save area is similar to getting and using a record descriptor. The save areas is turned off with AW_NOSAVE.

	int ad1, ad2, ad3;
/* Turn on and use save area ad1 */
	auditwrite(AW_SAVERD, &ad1, AW_END);
	auditwrite(AW_USERD, ad1, AW_END);

/* Put text at ad1 to be prepended to other records */
	auditwrite(AW_TEXT, "Prepended Text", AW_APPEND, AW_END);

/* Use the default record descriptor and write an event there */
	auditwrite(AW_DEFAULTRD, AW_END);
	auditwrite(AW_EVENT, "AUE_second_signature", 
		AW_TEXT, "Default record",
		AW_WRITE, AW_END);

/* Get and use record descriptor ad2 */
	auditwrite(AW_GETRD, &ad2, AW_END);
	auditwrite(AW_USERD, ad2, AW_END);

/* Write an event to ad2 */
	auditwrite(AW_EVENT, "AUE_second_signature", 
		AW_TEXT, "ad2 record", AW_WRITE, AW_END);

/* Discard the save area */
	auditwrite(AW_NOSAVE, AW_END);

/* Get and use record descriptor ad3 */
	auditwrite(AW_GETRD, &ad3, AW_END);
	auditwrite(AW_USERD, ad3, AW_END);

/* Write an event to ad3 */
	auditwrite(AW_EVENT, "AUE_second_signature_verify", 
   AW_TEXT, "ad3 with no prepend", AW_WRITE, AW_END);

The viewing terminal shows these records:


header,132,2,second signature requested,,Wed Sep 11 11:16:29 1996,
 + 133 msec
text,Prepended Text
text,Default record
subject,zelda,zelda,staff,zelda,staff,1983,536,0 0 phoenix
slabel,C
return,success,0

header,128,2,second signature requested,,Wed Sep 11 11:16:29 1996,
 + 140 msec
text,Prepended Text
text,ad2 record
subject,zelda,zelda,staff,zelda,staff,1983,536,0 0 phoenix
slabel,C

header,125,2,second signature added,,Wed Sep 11 11:16:29 1996,
 + 143 msec
text,ad3 with no prepend
subject,zelda,zelda,staff,zelda,staff,1983,536,0 0 phoenix
slabel,C