Managing Auditing in Oracle® Solaris 11.2

Exit Print View

Updated: July 2014

trailer Token

The two tokens, header and trailer, are special in that they distinguish the beginning and end points of an audit record and bracket all the other tokens. A header token begins an audit record. A trailer token ends an audit record. The trailer token is an optional token, and is added as the last token of each record only when the trail audit policy option has been set.

When an audit record is generated with trailers turned on, the auditreduce command can verify that the trailer token correctly points back to the record header. The trailer token supports backward seeks of the audit trail.

The praudit command displays the trailer token as follows: