trailer Token

The two tokens, header and trailer, are special in that they distinguish the end points of an audit record and bracket all the other tokens. A header token begins an audit record. A trailer token ends an audit record. The trailer token is an optional token. The trailer token is added as the last token of each record only when the trail audit policy has been set.

If an audit record was generated with trailers turned on, the auditreduce command verifies that the trailer points back to the record header correctly. The trailer token supports backward seeks of the audit trail.

The trailer token has three fields:

• A token ID that identifies this token as a trailer token

• A pad number to aid in marking the end of the record

• The total number of characters in the audit record, including both the header and trailer tokens

The praudit command displays the trailer token as follows:

trailer,136

The following figure shows the format of a trailer token.

Figure 23–28 trailer Token Format