NAME

audswitch − suspend or resume auditing on the current process

SYNOPSIS

#include <sys/audit.h> int audswitch (aflag)
int aflag;

DESCRIPTION

Audswitch suspends or resumes auditing within the current process.  This call is restricted to superusers. 

One of the following aflags must be used:

AUD_SUSPEND Suspend auditing on the current process. 

AUD_RESUME Resume auditing on the current process. 

Audswitch can be used in self-auditing privileged processes to temporarily suspend auditing during intervals where auditing is to be handled by the process itself.  Auditing is suspended by a call to audswitch with the AUD_SUSPEND parameter and resumed later by a call to audswitch with the AUD_RESUME parameter. 

An audswitch call to resume auditing serves only to reverse the action of a previous audswitch call to suspend auditing.  A call to audswitch to resume auditing when auditing is not suspended has no effect. 

Audswitch affects only the current process.  For example, audswitch cannot suspend auditing for processes exec’ed from the current process. (Use setaudproc(2) to enable or disable auditing for a process and its children).

RETURN VALUE

Upon successful completion, audswitch returns 0.  If an error occurs, −1 is returned and the global variable errno is set to indicate the error. 

ERRORS

Audswitch fails if one of the following is true:

[EPERM] The user is not a superuser. 

[EINVAL] The input parameter is neither AUD_RESUME nor AUD_SUSPEND. 

AUTHOR

Audswitch was developed by HP. 

SEE ALSO

audit(5), setaudproc(2), audusr(1M), audevent(1M). 

Hewlett-Packard Company  —  HP-UX Release 7.0: Sept 1989