attr Token

The attr token contains information from the file vnode. This token has seven fields:

• a token ID that identifies this token as an attr token

• the file access mode and type

• the owner user ID

• the owner group ID

• the file system ID

• the inode ID

• the device ID the file might represent

See the statvfs(2) man page for further information about the file system ID and the device ID.

The attr token usually accompanies a path token and is produced during path searches. In the event of a path-search error, the attr token is not included as part of the audit record since there is no vnode available to obtain the necessary file information. The praudit command displays the attr token as follows:

attribute,100555,root,staff,1805,13871,-4288

The following figure shows the format of an attr token.

Figure 25–7 attr Token Format