Print this page 
11842 Want audit events for auditon(A_SETPMASK) and friends
Reviewed by: John Levon <john.levon@joyent.com>
Reviewed by: Andy Fiddaman <andy@omniosce.org>
*** 457,466 ****
--- 457,496 ----
  #       argument,3,0x14,setqctrl:aq_delay
  #       subject,tuser10,tuser10,other,root,other,3969,367,255 197121 tmach1
  #       return,failure: Not owner,-1
  #       trailer,176
  
+ label=AUE_AUDITON_SETPMASK
+   format=[arg]1:[arg]2
+     comment=3, "setpmask&colon;pid", process
+     comment=3, "setpmask&colon;as_success", audit ID mask:
+     comment=3, "setpmask&colon;as_failure", audit ID mask
+   syscall=auditon: SETPMASK
+ 
+ label=AUE_AUDITON_SETKAUDIT
+   format=arg1:arg2:arg3:inaddr4:arg5:arg6:arg7
+     comment=1, audit user ID, "auid":
+     comment=1, terminal ID, "port":
+     comment=1, type, "type":
+     comment=1, terminal ID, "ip address":
+     comment=1, preselection mask, "as_success":
+     comment=1, preselection mask, "as_failure":
+     comment=1, audit session ID, "asid"
+   syscall=auditon: SETKAUDIT
+ 
+ label=AUE_AUDITON_GETPINFO
+   format=kernel
+   syscall=auditon: GETPINFO
+ 
+ label=AUE_AUDITON_GETKAUDIT
+   format=kernel
+   syscall=auditon: GETKAUDIT
+ 
+ label=AUE_AUDITON_OTHER
+   format=kernel
+   syscall=auditon: OTHER
+ 
  label=AUE_AUDITON_STERMID
    skip=Not used.
  
  label=AUE_AUDITSTAT
    skip=Not used.