bsd/man/man2/auditctl.2

   1 .\"
   2 .\" Copyright (c) 2007 Apple Inc. All rights reserved.
   3 .\"
   4 .\" @APPLE_LICENSE_HEADER_START@
   5 .\"
   6 .\" This file contains Original Code and/or Modifications of Original Code
   7 .\" as defined in and that are subject to the Apple Public Source License
   8 .\" Version 2.0 (the 'License'). You may not use this file except in
   9 .\" compliance with the License. Please obtain a copy of the License at
  10 .\" http://www.opensource.apple.com/apsl/ and read it before using this
  11 .\" file.
  12 .\"
  13 .\" The Original Code and all software distributed under the License are
  14 .\" distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  15 .\" EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  16 .\" INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  17 .\" FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  18 .\" Please see the License for the specific language governing rights and
  19 .\" limitations under the License.
  20 .\"
  21 .\" @APPLE_LICENSE_HEADER_END@
  22 .\"
  23 .Dd July 30, 2007
  24 .Dt AUDITCTL 2
  25 .Os Darwin
  26 .Sh NAME
  27 .Nm auditctl
  28 .Nd specify a new file for the audit trail to log to
  29 .Sh SYNOPSIS
  30 .Fd #include <bsm/audit.h>
  31 .Ft int
  32 .Fn auditctl "const char * path"
  33 .Sh DESCRIPTION
  34 The
  35 .Fn auditctl
  36 function directs the kernel to begin writing the global audit trail to the
  37 specified to the file specified by
  38 .Fa path .
  39 Specifying a
  40 .Fa path
  41 of NULL will tell the system to stop writing to the audit trail, without
  42 disabling audit. To begin writing to a file again, simply pass another
  43 path.
  44 .Sh RETURN VALUES
  45 Upon successful completion a value of 0 is returned.
  46 Otherwise, a value of -1 is returned and
  47 .Va errno
  48 is set to indicate the error.
  49 .Sh SEE ALSO
  50 .Xr audit 2 ,
  51 .Xr auditon 2 ,
  52 .Xr getauid 2 ,
  53 .Xr setauid 2 ,
  54 .Xr getaudit 2 ,
  55 .Xr setaudit 2
  56 .Sh HISTORY
  57 The
  58 .Fn auditctl
  59 function call first appeared in Mac OS X 10.3 (Panther).