xdas_put_event_info(D3xdas)
xdas_put_event_info --
add specific event information to an audit record buffer
Synopsis
#include <sys/xdas.h>
OM_uint32 xdas_put_event_info(
OM_uint32 *minor_status,
const xdas_audit_ref_t *das_ref,
const xdas_audit_desc_t *audit_record_descriptor,
const OM_unit32 event_number,
const OM_unit32 outcome,
const xdas_buffer_t *initiator_information,
const xdas_buffer_t *target_information,
const xdas_buffer_t *event_information);
Description
The
xdas_put_event_info(D3xdas)
function is a member of the XDAS Event Submission API
Option Conformance class.
xdas_put_event_info(D3xdas)
adds event information to an
audit record or overwrites existing information. If the
combination of information submitted and already present in the
audit record referred to by audit_record_descriptor is
insufficient to evaluate applicable pre-selection criteria, the
function returns XDAS_S_NO_DECISION_YET to the caller. If there is
sufficient information for evaluation of applicable pre-selection
checks the XDAS_S_COMPLETE or
XDAS_S_NO_AUDIT are returned to the caller.
Multiple calls to
xdas_put_event_info(D3xdas)
may be made. For any individual parameter, information
supplied in this call will
overwrite any previous information supplied.
Although several parameters are optional in this call, a caller
must have populated all the parameters, even when empty, in one
or more sequences of calls to
xdas_start_record(D3xdas)
and
xdas_put_event_info(D3xdas)
before a call to
xdas_commit_record(D3xdas)
can be successful.
The caller must have the XDAS_AUDIT_SUBMIT authority.
If successful, the function returns XDAS_S_COMPLETE,
XDAS_S_NO_DECISION_YET or XDAS_S_NO_AUDIT.
If XDAS_S_NO_AUDIT is returned, audit_record_descriptor
is no longer a valid reference to an audit record.
If XDAS_S_NO_DECISION_YET is returned, the caller should
continue to construct the audit record by subsequent calls to
xdas_put_event_info(D3xdas).
Arguments
minor_status-
(Output)
An implementation specific return status that provides
additional information when XDAS_S_FAILURE is returned by
the function.
das_ref-
(Input)
The handle to the XDAS server, obtained from a previous call to
xdas_initialise_session(D3xdas).
audit_record_descriptor-
(Input)
The handle to the audit record, obtained from a previous call
to
xdas_start_record(D3xdas).
event_number-
(Optional input)
The event number of the detected event. If specified as a
NULL value then the event number currently associated with
audit_record_descriptor is unchanged.
Otherwise, event_number overwrites the current value.
Only registered event numbers configured are valid. Any other
event number results in the return of XDAS_S_INVALID_EVENT_NO.
outcome-
(Optional input)
The outcome of the event determined by the caller. If
specified as a NULL value then the outcome code currently
associated with audit_record_descriptor is unchanged by this
call. Otherwise outcome_code overwrites the current value.
Only the outcome codes listed in
``XDAS events''
are valid.
initiator_information-
(Optional input)
The information describing the initiator in the format
required by the XDAS common audit format. If specified as
XDAS_C_NO_BUFFER the current initiator information associated
with the audit_record_descriptor supplied is unchanged by
this call. Otherwise the contents of
initiator_information overwrite the current value associated with
audit_record_descriptor.
target_information-
(Optional input)
The information on the target of the event in the format
required by the XDAS common audit format.
If specified as
XDAS_C_NO_BUFFER the current target information associated
with the audit_record_descriptor supplied is unchanged by
this call. Otherwise the contents of target_information
overwrite the current value associated with
audit_record_descriptor.
event_information-
(Optional input)
The event specific information that is to be added to the
audit record specified by audit_record_descriptor.
If specified as XDAS_C_NO_BUFFER the current event specific
information associated with the audit_record_descriptor
supplied is unchanged by this call. Otherwise the contents of
event_information overwrite the current value associated with
audit_record_descriptor.
Return values
XDAS_S_COMPLETE-
Successful completion.
XDAS_S_FAILURE-
An implementation specific error or failure has occurred, such as
missing required parameters, or a kernel allocated memory failure.
XDAS_S_INVALID_DAS_REF-
The audit service handle supplied does not point to the audit service.
XDAS_S_INVALID_EVENT_INFO-
The specified audit event information is invalid.
XDAS_S_INVALID_EVENT_NO-
The specified event number is invalid.
XDAS_S_INVALID_INITIATOR_INFO-
The initiator information supplied has a syntax error.
XDAS_S_INVALID_OUTCOME-
The specified outcome is not valid.
XDAS_S_INVALID_RECORD_DESCRIPTOR-
The specified audit record descriptor is invalid.
XDAS_S_INVALID_TARGET_INFO-
The specified target information has a syntax error.
XDAS_S_NO_AUDIT-
The event specified does not need to be audited.
XDAS_S_NO_DECISION_YET-
The audit service has insufficient information to decide if
the event requires auditing.
References
xdas_put_event_info,
xdas_commit_record(D3xdas),
xdas_start_record(D3xdas)
© 2005 The SCO Group, Inc. All rights reserved.
OpenServer 6 and UnixWare (SVR5) HDK - 19 June 2005