xdas_put_event_info(D3xdas)

Synopsis

#include <sys/xdas.h>

OM_uint32 xdas_put_event_info(
	OM_uint32 *minor_status,
	const xdas_audit_ref_t *das_ref,
	const xdas_audit_desc_t *audit_record_descriptor,
	const OM_unit32 event_number,
	const OM_unit32 outcome,
	const xdas_buffer_t *initiator_information,
	const xdas_buffer_t *target_information,
	const xdas_buffer_t *event_information);

Description

xdas_put_event_info(D3xdas) adds event information to an audit record or overwrites existing information. If the combination of information submitted and already present in the audit record referred to by audit_record_descriptor is insufficient to evaluate applicable pre-selection criteria, the function returns XDAS_S_NO_DECISION_YET to the caller. If there is sufficient information for evaluation of applicable pre-selection checks the XDAS_S_COMPLETE or XDAS_S_NO_AUDIT are returned to the caller. Multiple calls to xdas_put_event_info(D3xdas) may be made. For any individual parameter, information supplied in this call will overwrite any previous information supplied.

Although several parameters are optional in this call, a caller must have populated all the parameters, even when empty, in one or more sequences of calls to xdas_start_record(D3xdas) and xdas_put_event_info(D3xdas) before a call to xdas_commit_record(D3xdas) can be successful.

The caller must have the XDAS_AUDIT_SUBMIT authority.

If successful, the function returns XDAS_S_COMPLETE, XDAS_S_NO_DECISION_YET or XDAS_S_NO_AUDIT. If XDAS_S_NO_AUDIT is returned, audit_record_descriptor is no longer a valid reference to an audit record.

If XDAS_S_NO_DECISION_YET is returned, the caller should continue to construct the audit record by subsequent calls to xdas_put_event_info(D3xdas).

Arguments

minor_status

(Output) An implementation specific return status that provides additional information when XDAS_S_FAILURE is returned by the function.

das_ref

(Input) The handle to the XDAS server, obtained from a previous call to xdas_initialise_session(D3xdas).

audit_record_descriptor

(Input) The handle to the audit record, obtained from a previous call to xdas_start_record(D3xdas).

event_number

(Optional input) The event number of the detected event. If specified as a NULL value then the event number currently associated with audit_record_descriptor is unchanged. Otherwise, event_number overwrites the current value. Only registered event numbers configured are valid. Any other event number results in the return of XDAS_S_INVALID_EVENT_NO.

outcome

(Optional input) The outcome of the event determined by the caller. If specified as a NULL value then the outcome code currently associated with audit_record_descriptor is unchanged by this call. Otherwise outcome_code overwrites the current value. Only the outcome codes listed in ``XDAS events'' are valid.

initiator_information

(Optional input) The information describing the initiator in the format required by the XDAS common audit format. If specified as XDAS_C_NO_BUFFER the current initiator information associated with the audit_record_descriptor supplied is unchanged by this call. Otherwise the contents of initiator_information overwrite the current value associated with audit_record_descriptor.

target_information

(Optional input) The information on the target of the event in the format required by the XDAS common audit format. If specified as XDAS_C_NO_BUFFER the current target information associated with the audit_record_descriptor supplied is unchanged by this call. Otherwise the contents of target_information overwrite the current value associated with audit_record_descriptor.

event_information

(Optional input) The event specific information that is to be added to the audit record specified by audit_record_descriptor. If specified as XDAS_C_NO_BUFFER the current event specific information associated with the audit_record_descriptor supplied is unchanged by this call. Otherwise the contents of event_information overwrite the current value associated with audit_record_descriptor.

Return values

XDAS_S_COMPLETE

Successful completion.

XDAS_S_FAILURE

An implementation specific error or failure has occurred, such as missing required parameters, or a kernel allocated memory failure.

XDAS_S_INVALID_DAS_REF

The audit service handle supplied does not point to the audit service.

XDAS_S_INVALID_EVENT_INFO

The specified audit event information is invalid.

XDAS_S_INVALID_EVENT_NO

The specified event number is invalid.

XDAS_S_INVALID_INITIATOR_INFO

The initiator information supplied has a syntax error.

XDAS_S_INVALID_OUTCOME

The specified outcome is not valid.

XDAS_S_INVALID_RECORD_DESCRIPTOR

The specified audit record descriptor is invalid.

XDAS_S_INVALID_TARGET_INFO

The specified target information has a syntax error.

XDAS_S_NO_AUDIT

The event specified does not need to be audited.

XDAS_S_NO_DECISION_YET

The audit service has insufficient information to decide if the event requires auditing.

References