return Token

The return token contains the return status of the system call (u_error) and the process return value (u_rval1).

The return token has three fields:

• A token ID that identifies this token as a return token

• The error status of the system call

• The return value of the system call

The return token is always returned as part of kernel-generated audit records for system calls. In application auditing, this token indicates exit status and other return values.

The praudit command displays the return token for a system call as follows:

return,failure: Operation now in progress,-1

The praudit -x command shows the fields of the return token:

<return errval="failure: Operation now in progress" retval="-1/">