Lines Matching refs:audit
26 * Routines for writing audit records.
49 #include <c2/audit.h>
71 * Write to an audit descriptor.
100 * Close an audit descriptor.
132 * Defer closing/queueing of an audit descriptor. For async events, queue
195 * from both au_close() (for kernel audit) and from audit() (userland audit).
226 * Close an audit descriptor.
249 /* if auditing not enabled, then don't generate an audit record */
260 * an audit record.
320 /* append body of audit record */
334 /* link to audit record (i.e. don't pack the data) */
353 * 1 - use 64 bit version of audit tokens for 64 bit kernels.
354 * 0 - use 32 bit version of audit tokens for 32 bit kernels.
405 /* count # audit records put onto kernel audit queue */
459 * if we sleep or we should drop the audit record.
477 /* just count # of dropped audit records */
503 * if we reboot we should drop the audit record.
578 * Write an audit control message to the door handle. The message
614 * Write audit information to the door handle. au_doorio is called with
615 * one or more complete audit records on the queue and outputs those
638 int part = 0; /* partial audit record written */
669 part = 1; /* indicate audit record being processed */
688 /* advance to next audit record */
708 * if we've successfully written an audit record,
727 * Clean up thread audit state to clear out asynchronous audit record
745 /* clean out partial audit record */
753 * implement the audit policy for asynchronous events generated within
762 /* could not generate audit record, clean up */
770 /* just count # of dropped audit records */
776 * There can be a lot of data in the audit queue. We
799 /* if audit state off, then no audit record generation */
842 * Backend routine to complete an async audit. Invoked from softcall.
864 * Call au_close_time to complete the audit with the saved values.