The file token is a special token that is generated by the audit daemon. The token marks the beginning of a new audit file and the end of an old audit file as the old file is deactivated. The audit daemon builds a special audit record that contains this token to “link” together successive audit files into one audit trail. The file token has four fields:
A token ID that identifies this token as a file token
A time and date stamp that identifies the time that the file was created or was closed
A byte count of the file name that includes a null terminator
A field that holds the file null-terminated name
The praudit command displays the file token as follows:
file,Tue Sep 1 13:32:42 1992, + 79249 msec, /var/audit/localhost/files/19990901202558.19990901203241.quisp |
The following figure shows the format of a file token.