cobaudit_event

Outputs an audit event.

Restriction: This topic applies only when the Enterprise Server feature is enabled.

Syntax:

cobrtncode_t cobaudit_event(cobuns32_t      flags_p,
               	const cobuns8_t *component_id,
               	AUDIT_EVENT     *audit_event)

Control flags

Bit	Value	Meaning
0-29		Reserved for future use (must be 0)
30	0	component-name is space-terminated
	1	component-name is null-terminated
		(ignored if bit 31 unset)
31		Reserved for future use (must be 0)

component_id: Component identifier. This will either be a 32-bit unsigned integer tracer handle (See CBL_AUDIT_HANDLE_GET() - Get an Audit Handle for details about how a component acquires an audit handle) if bit 31 of flags is not set, or a text identifier if bit 31 of flags is set.

audit_event

Audit event structure

version	Structure version. Must be 0.
flags	Control flags. Must be 0.
event_id	Component specific event identifier used to identify the type of event being output.
event_category	Audit event category.
data_count	Number of audit data items. Indicates the number of elements in the event_len, event_type, and event_data arrays. May be 0.
event_len	Pointer to array of 32-bit unsigned integers. Each array element indicates the length of the corresponding audit data item in the event_data array. May be NULL if data_count is 0.
event_type	Pointer to array of 32-bit unsigned integers. Each array element indicates the type of the corresponding audit data item in the event_data array. May be NULL if data_count is 0. Any value other than the ones specified above will be treated as type 0 (binary). 0 Binary 1 Text (local encoding) 2 Address 3 COMP-5 4 COMP-X 5 UTF8 6 Signed COMP-5 7 Signed COMP-X
event_data	Pointer to array of pointer items. Each array element addresses an audit data item of the type and length indicated by the corresponding element in the event_type and event_len arrays respectively. May be NULL if data_count is 0. N.B. for address type items, the array element is the address value, and not a pointer to the address value.