Lines Matching +full:stream +full:- +full:id +full:- +full:range
1 .\"-
2 .\" Copyright (c) 2005-2006 Robert N. M. Watson
37 token-based record stream to represent system audit data.
39 range of data types, and easily extended to describe new data types in a
44 token, which provides time stamp and file name information for the stream;
45 when processing a BSM token stream from a stream as opposed to a single file
47 identifying when particular parts of the stream begin and end.
79 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
81 .It "Token ID 1 byte Token ID"
93 A 32-bit
97 a 64-bit
101 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
103 .It "Token ID 1 byte Token ID"
107 .It "Event Modifier 2 bytes Event sub-type"
108 .It "Seconds 4/8 bytes Record time stamp (32/64-bits)"
109 .It "Nanoseconds 4/8 bytes Record time stamp (32/64-bits)"
117 A 32-bit extended
121 a 64-bit extended
125 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
127 .It "Token ID 1 byte Token ID"
131 .It "Event Modifier 2 bytes Event sub-type"
134 .It "Seconds 4/8 bytes Record time stamp (32/64-bits)"
135 .It "Nanoseconds 4/8 bytes Record time stamp (32/64-bits)"
147 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
149 .It "Token ID 1 byte Token ID"
156 token contains a byte stream of opaque (untyped) data.
167 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
169 .It "Token ID 1 byte Token ID"
170 .It "How to Print 1 byte User-defined printing information"
184 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
186 .It "Token ID 1 byte Token ID"
202 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
204 .It "Token ID 1 byte Token ID"
216 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
218 .It "Token ID 1 byte Token ID"
222 .It "ID 2 bytes IP header ID for reassembly"
224 .It "TTL 1 byte IP Time-to-Live"
238 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
240 .It "Token ID 1 byte Token ID"
251 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
253 .It "Token ID 1 byte Token ID"
260 token contains a set of NUL-terminated path names.
266 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
268 .It "Token ID 1 byte Token ID"
269 .It "Count 2 bytes Number of NUL-terminated string(s) in token"
270 .It "Path Variable count NUL-terminated string(s)"
284 information such as the audit user ID and session.
291 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
293 .It "Token ID 1 byte Token ID"
294 .It "Audit ID 4 bytes Audit user ID"
295 .It "Effective User ID 4 bytes Effective user ID"
296 .It "Effective Group ID 4 bytes Effective group ID"
297 .It "Real User ID 4 bytes Real user ID"
298 .It "Real Group ID 4 bytes Real group ID"
299 .It "Process ID 4 bytes Process ID"
300 .It "Session ID 4 bytes Audit session ID"
301 .It "Terminal Port ID 4/8 bytes Terminal port ID (32/64-bits)"
317 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
319 .It "Token ID 1 byte Token ID"
320 .It "Audit ID 4 bytes Audit user ID"
321 .It "Effective User ID 4 bytes Effective user ID"
322 .It "Effective Group ID 4 bytes Effective group ID"
323 .It "Real User ID 4 bytes Real user ID"
324 .It "Real Group ID 4 bytes Real group ID"
325 .It "Process ID 4 bytes Process ID"
326 .It "Session ID 4 bytes Audit session ID"
327 .It "Terminal Port ID 4/8 bytes Terminal port ID (32/64-bits)"
343 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
345 .It "Token ID 1 byte Token ID"
347 .It "Return Value 4/8 bytes Return value (32/64-bits)"
366 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
368 .It "Token ID 1 byte Token ID"
369 .It "Audit ID 4 bytes Audit user ID"
370 .It "Effective User ID 4 bytes Effective user ID"
371 .It "Effective Group ID 4 bytes Effective group ID"
372 .It "Real User ID 4 bytes Real user ID"
373 .It "Real Group ID 4 bytes Real group ID"
374 .It "Process ID 4 bytes Process ID"
375 .It "Session ID 4 bytes Audit session ID"
376 .It "Terminal Port ID 4/8 bytes Terminal port ID (32/64-bits)"
385 information in the terminal ID.
392 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
394 .It "Token ID 1 byte Token ID"
395 .It "Audit ID 4 bytes Audit user ID"
396 .It "Effective User ID 4 bytes Effective user ID"
397 .It "Effective Group ID 4 bytes Effective group ID"
398 .It "Real User ID 4 bytes Real user ID"
399 .It "Real Group ID 4 bytes Real group ID"
400 .It "Process ID 4 bytes Process ID"
401 .It "Session ID 4 bytes Audit session ID"
402 .It "Terminal Port ID 4/8 bytes Terminal port ID (32/64-bits)"
413 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
415 .It "Token ID 1 byte Token ID"
416 .It "Object ID type 1 byte Object ID"
417 .It "Object ID 4 bytes Object ID"
422 token contains a single NUL-terminated text string.
427 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
429 .It "Token ID 1 byte Token ID"
448 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
450 .It "Token ID 1 byte Token ID"
452 .It "Owner User ID 4 bytes uid_t associated with file"
453 .It "Owner Group ID 4 bytes gid_t associated with file"
454 .It "File System ID 4 bytes fsid_t associated with file"
455 .It "File System Node ID 8 bytes ino_t associated with file"
456 .It "Device 4/8 bytes Device major/minor number (32/64-bit)"
466 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
468 .It "Token ID 1 byte Token ID"
478 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
480 .It "Token ID 1 byte Token ID"
481 .It Li "Owner user ID" Ta "4 bytes" Ta "User ID of IPC owner"
482 .It Li "Owner group ID" Ta "4 bytes" Ta "Group ID of IPC owner"
483 .It Li "Creator user ID" Ta "4 bytes" Ta "User ID of IPC creator"
484 .It Li "Creator group ID" Ta "4 bytes" Ta "Group ID of IPC creator"
498 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
500 .It "Token ID 1 byte Token ID"
501 .It Li "Argument ID" Ta "1 byte" Ta "Argument ID"
512 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
514 .It "Token ID 1 byte Token ID"
516 .It Li "Text" Ta "* bytes" Ta "Count nul-terminated strings"
524 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
526 .It "Token ID 1 byte Token ID"
527 .It Li "Count ID" Ta "4 bytes" Ta "Number of variables"
528 .It Li "Text" Ta "* bytes" Ta "Count nul-terminated strings"
538 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
540 .It "Token ID 1 byte Token ID"
554 .Bl -column -offset 3n ".Sy Field Name Width XX" ".Sy XX Bytes XXXX" ".Sy Description"
556 .It Li "Token ID" Ta "1 byte" Ta "Token ID"
569 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
571 .It Li "Token ID" Ta "1 byte" Ta "Token ID"
583 token contains a unique and monotonically increasing audit event sequence ID.
584 Due to the limited range of 32 bits, serial number arithmetic and caution
586 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
588 .It "Token ID 1 byte Token ID"
595 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
597 .It "Token ID 1 byte Token ID"
599 .Ss Use-of-auth Token
601 .Dq use-of-auth
603 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
605 .It "Token ID 1 byte Token ID"
611 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
613 .It "Token ID 1 byte Token ID"
619 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
621 .It "Token ID 1 byte Token ID"
626 token holds a NUL-terminated string with the name of the zone or jail from
632 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
634 .It "Token ID 1 byte Token ID"
652 stream format were defined by Sun Microsystems.