Lines Matching +full:current +full:- +full:limit

30 .Nd "pseudo-device for live audit event tracking"
39 provide a reliable long-term store for audit log information, current log
41 unwieldy for live monitoring applications such as host-based intrusion
47 direct access to live BSM audit data for the purposes of real-time
64 Audit pipe devices are blocking by default, but support non-blocking I/O,
77 .Bl -tag -width ".Dv AUDITPIPE_GET_MAXAUDITDATA"
79 Query the current number of records available for reading on the pipe.
81 Retrieve the current maximum number of records that may be queued for reading
84 Set the current maximum number of records that may be queued for reading on
86 The new limit must fall between the queue limit minimum and queue limit
104 matched by the system-wide audit trail, configured by
107 alternative criteria, including pipe-local flags and naflags settings, as
108 well as auid-specific selection masks.
110 trail, as well as limit records presented to those of specific interest to
114 .Bl -tag -width ".Dv AUDITPIPE_GET_PRESELECT_MODE"
116 Return the current preselect mode on the audit pipe.
120 Set the current preselection mode on the audit pipe.
126 .Bl -tag -width ".Dv AUDITPIPE_PRESELECT_MODE_TRAIL"
133 as well as a set of per-auid masks.
139 The application may flush the current record queue after changing the
146 .Bl -tag -width ".Dv AUDITPIPE_GET_PRESELECT_NAFLAGS"
148 Retrieve the current default preselection flags for attributable events on
157 Set the current default preselection flags for attributable events on the
166 Retrieve the current default preselection flags for non-attributable events
175 Set the current default preselection flags for non-attributable events on the
184 Query the current preselection masks for a specific auid on the pipe.
196 Set the current preselection masks for a specific auid on the pipe.
203 Delete the current preselection mask for a specific auid on the pipe.
243 manual page for information on audit-related bugs and limitations.
249 The per-pipe audit event queue is fifo, with drops occurring if either the