AUDITSVC(2) — SYSTEM CALLS

NAME

auditsvc − write audit records to specified file descriptor

SYNOPSIS

auditsvc(fd, limit)
int fd;
int limit;

DESCRIPTION

The auditsvc() system call specifies the audit log file to the kernel. The kernel writes audit records to this file until an exceptional condition occurs and then the call returns. The parameter fd is a file descriptor that identifies the audit file. Programs should open this file for writing before calling auditsvc. The parameter limit specifies a value between 0 and 100, instructing auditsvc() to return when the percentage of free disk space on the audit filesystem drops below this limit. Thus, the invoking program can take action to avoid running out of disk space. The auditsvc() system call does not return until one of the following conditions occurs:

• The process receives a signal that is not blocked or ignored.

• An error is encountered writing to the audit log file.

• The minimum free space (as specified by limit), has been reached.

Only processes with a real or effective user ID of super-user may execute this call successfully.

RETURN VALUE

This call only returns on an error.

ERRORS

EPERM The process’s effective or real user ID is not super-user.

EBUSY A second process attempted to perform this call.

EBADF d is not a valid descriptor open for writing.

EPIPE An attempt is made to write to a pipe that is not open for reading by any process (or to a socket of type SOCK_STREAM that is connected to a peer socket.) Note: an attempted write of this kind will also cause you to receive a SIGPIPE signal from the kernel. If you’ve not made a special provision to catch or ignore this signal, your process will die.

EFBIG An attempt was made to write a file that exceeds the process’s file size limit or the maximum file size.

EINTR The call is forced to terminate prematurely due to the arrival of a signal whose SV_INTERRUPT bit in sv_flags is set (see sigvec(2)). signal(3V), in the System V compatibility library, sets this bit for any signal it catches.

ENOSPC There is no free space remaining on the file system containing the file.

EDQUOT The user’s quota of disk blocks on the file system containing the file has been exhausted.

EDQUOT Audit filesystem space is below the specified limit.

EIO An I/O error occurred while reading from or writing to the file system.

ENXIO A hangup occurred on the stream being written to.

EWOULDBLOCK The file was marked for 4.2BSD-style non-blocking I/O, and no data could be written immediately.

EAGAIN The descriptor referred to a stream, was marked for System V-style non-blocking I/O, and no data could be written immediately.