newgroups Token

This token replaces the group token. Notice that the praudit command does not distinguish between the two tokens, as both token IDs are labeled group in praudit output.

The newgroups token records the group entries from the process's credential. The newgroups token has two fixed fields:

• A token ID field that identifies this token as a newgroups token

• A count that represents the number of groups that are contained in this audit record

The remainder of this token is composed of zero or more group entries. The praudit command displays the newgroups token as follows:

group, staff, admin

The following figure shows the format of a newgroups token.

Figure 23–19 newgroups Token Format

The newgroups token is output only when the group audit policy is active.