Event-Specific Information
The Audit APIs allow applications to include event-specific information in audit records. Event-specific information must be represented as information items using the following data type.
typedef struct {
unsigned16 format;
union {
idl_small_int small_int;
idl_short_int
short_int;
idl_long_int long_int;
idl_hyper_int hyper_int;
idl_usmall_int usmall_int;
idl_ushort_int ushort_int;
idl_ulong_int ulong_int;
idl_uhyper_int uhyper_int;
idl_short_float short_float;
idl_long_float long_float;
idl_boolean boolean;
uuid_t uuid;
utc_t utc;
sec_acl_t * acl;
idl_byte * byte_string;
idl_char * char_string;
} data;
} dce_aud_ev_info_t;
The format field of the above data structure defines formatting information that is used to determine the type of the data referenced by the data field. The following table shows possible values of the format field, their corresponding data types, and their sizes.
| Event Data Format Specifiers - intro(3sec) |
| Specifier | Data Type | Size |
| aud_c_evt_info_small_int | idl_small_int | 1 byte |
| aud_c_evt_info_short_int | idl_short_int | 2 bytes |
| aud_c_evt_info_long_int | idl_long_int | 4 bytes |
| aud_c_evt_info_hyper_int | idl_hyper_int | 8 bytes |
| aud_c_evt_info_usmall_int | idl_usmall_int | 1 bytes |
| aud_c_evt_info_ushort_int | idl_ushort_int | 2 bytes |
| aud_c_evt_info_ulong_int | idl_ulong_int | 4 bytes |
| aud_c_evt_info_uhyper_int | idl_uhyper_int | 8 bytes |
| aud_c_evt_info_short_float | idl_short_float | 4 bytes |
| aud_c_evt_info_long_float | idl_long_float | 8 bytes |
| aud_c_evt_info_boolean | idl_boolean | 1 byte |
| aud_c_evt_info_uuid | uuid_t | 16 bytes |
| aud_c_evt_info_utc | utc_t | 16 bytes |
| aud_c_evt_info_acl | sec_acl_t * | variable size |
| aud_c_evt_info_byte_string | idl_byte * | variable size |
| aud_c_evt_info_char_string | idl_char * | variable size |