audit(S)                       6 January 1993                       audit(S)


 Name

    audit_close, audit_open, audit_read - open and access audit session data
    records

 Syntax


    cc ... -lprot


    int audit_close()

    int audit_open (session)
    int session;

    struct audit_header *audit_read()


 Description

    The auditopen routine provides an interface for opening an audit data
    session which has been previously collected on the system. The routine
    requires one argument, session, which indicates the audit session number.
    This may be acquired from a session list by using the auditsh(ADM) util-
    ity.

    Once a session is open, auditread sequentially retrieves audit records
    from the audit session data files. Each call returns a pointer to the
    next audit record header which identifies the record size, the record
    type, the event type, and other audit related information. The actual
    record formats are defined in audit(HW).  The routine returns a NULL
    pointer if an error or end-of-file occurs.

    Before another session may be accessed, use auditclose to terminate pro-
    cessing for the current session. Another session may then be opened.

 Return value

    Upon successful completion, auditopen and auditclose return a value of
    ``0''.  Otherwise, they return  a value of ``-1'' with errno set to indi-
    cate the appropriate error. auditread returns a pointer to the next
    audit record  on success.  auditread returns a NULL if an error occurs
    or EOF is encountered.

 See also

    auditsh(ADM), audit(HW), authaudit(S)

 Standards conformance

    auditclose, auditopen and auditread are not part of any currently sup-
    ported standard; they are extensions of AT&T System V provided by the
    Santa Cruz Operation.