Audit entry data structures begin with a fixed-length header, defined as follows: 

struct audit_entry {
     unsigned short ae_len;
     unsigned short ae_reserved;
     unsigned long  ae_time;
     unsigned short ae_type;
     unsigned short ae_data_offset; /* offset from beginning address
                                           /*  of audit_entry to ae_data */
};

Variable-length data specific to the type of audit entry follows: 

         unsigned char  ae_data[];
         unsigned short ae_len2;

where:

[Back] [Next]