return Token

The return token contains the return status of the system call (u_error) and the process return value (u_rval1). This token has three fields:

• a token ID that identifies this token as a return token

• the error status of the system call

• the system call return value

The return token is always returned as part of kernel-generated audit records for system calls. This token indicates exit status and other return values in application auditing.

The praudit command displays the return token as follows:

return,success,0

The following figures shows the format of a return token.

Figure 25–23 return Token Format