xdas_put_event_info(3xdas)


xdas_put_event_info -- add specific event information to an audit record buffer

Synopsis

cc [flag ...] file ... -Kthread -leels [library] ...
#include <sys/xdas.h>

OM_uint32 xdas_put_event_info( OM_uint32 *minor_status, const xdas_audit_ref_t *das_ref, const xdas_audit_desc_t *audit_record_descriptor, const OM_unit32 event_number, const OM_unit32 outcome, const xdas_buffer_t *initiator_information, const xdas_buffer_t *target_information, const xdas_buffer_t *event_information);

Description

The xdas_put_event_info(3xdas) function is a member of the XDAS Event Submission API Option Conformance class.

xdas_put_event_info(3xdas) adds event information to an audit record or overwrites existing information. If the combination of information submitted and already present in the audit record referred to by audit_record_descriptor is insufficient to evaluate applicable pre-selection criteria, the function returns XDAS_S_NO_DECISION_YET to the caller. If there is sufficient information for evaluation of applicable pre-selection checks the XDAS_S_COMPLETE or XDAS_S_NO_AUDIT are returned to the caller. Multiple calls to xdas_put_event_info(3xdas) may be made. For any individual parameter, information supplied in this call will overwrite any previous information supplied.

Although several parameters are optional in this call, a caller must have populated all the parameters, even when empty, in one or more sequences of calls to xdas_start_record(3xdas) and xdas_put_event_info(3xdas) before a call to xdas_commit_record(3xdas) can be successful.

The caller must have the XDAS_AUDIT_SUBMIT authority.

If successful, the function returns XDAS_S_COMPLETE, XDAS_S_NO_DECISION_YET or XDAS_S_NO_AUDIT. If XDAS_S_NO_AUDIT is returned, audit_record_descriptor is no longer a valid reference to an audit record.

If XDAS_S_NO_DECISION_YET is returned, the caller should continue to construct the audit record by subsequent calls to xdas_put_event_info(3xdas).

Arguments


minor_status
(Output) An implementation specific return status that provides additional information when XDAS_S_FAILURE is returned by the function.

das_ref
(Input) The handle to the XDAS server, obtained from a previous call to xdas_initialise_session(3xdas).

audit_record_descriptor
(Input) The handle to the audit record, obtained from a previous call to xdas_start_record(3xdas).

event_number
(Optional input) The event number of the detected event. If specified as a NULL value then the event number currently associated with audit_record_descriptor is unchanged. Otherwise, event_number overwrites the current value. Only registered event numbers configured are valid. Any other event number results in the return of XDAS_S_INVALID_EVENT_NO.

outcome
(Optional input) The outcome of the event determined by the caller. If specified as a NULL value then the outcome code currently associated with audit_record_descriptor is unchanged by this call. Otherwise outcome_code overwrites the current value. Only the outcome codes listed in ``XDAS events'' are valid.

initiator_information
(Optional input) The information describing the initiator in the format required by the XDAS common audit format. If specified as XDAS_C_NO_BUFFER the current initiator information associated with the audit_record_descriptor supplied is unchanged by this call. Otherwise the contents of initiator_information overwrite the current value associated with audit_record_descriptor.

target_information
(Optional input) The information on the target of the event in the format required by the XDAS common audit format. If specified as XDAS_C_NO_BUFFER the current target information associated with the audit_record_descriptor supplied is unchanged by this call. Otherwise the contents of target_information overwrite the current value associated with audit_record_descriptor.

event_information
(Optional input) The event specific information that is to be added to the audit record specified by audit_record_descriptor. If specified as XDAS_C_NO_BUFFER the current event specific information associated with the audit_record_descriptor supplied is unchanged by this call. Otherwise the contents of event_information overwrite the current value associated with audit_record_descriptor.

Return values


XDAS_S_AUTHORISATION_FAILURE
The caller does not possess the required authority.

XDAS_S_COMPLETE
Successful completion.

XDAS_S_FAILURE
An implementation specific error or failure has occurred, such as missing required parameters, or a malloc failure.

XDAS_S_INVALID_DAS_REF
The audit service handle supplied does not point to the audit service.

XDAS_S_INVALID_EVENT_INFO
The specified audit event information is invalid.

XDAS_S_INVALID_EVENT_NO
The specified event number is invalid.

XDAS_S_INVALID_INITIATOR_INFO
The initiator information supplied has a syntax error.

XDAS_S_INVALID_OUTCOME
The specified outcome is not valid.

XDAS_S_INVALID_RECORD_DESCRIPTOR
The specified audit record descriptor is invalid.

XDAS_S_INVALID_TARGET_INFO
The specified target information has a syntax error.

XDAS_S_NO_AUDIT
The event specified does not need to be audited.

XDAS_S_NO_DECISION_YET
The audit service has insufficient information to decide if the event requires auditing.

References

xdas_put_event_info(D3xdas), xdas_commit_record(3xdas), xdas_start_record(3xdas)


© 2004 The SCO Group, Inc. All rights reserved.
UnixWare 7 Release 7.1.4 - 25 April 2004