saton(2)                                                              saton(2)


NAME
     saton, satoff, satstate - control the collection of audit data

C SYNOPSIS
     #include <sys/sat.h>
     int saton (int eventtype);
     int satoff (int eventtype);
     int satstate (int eventtype);

DESCRIPTION
     saton switches
      on collection of audit records of the specified event type.

     satoff switches
      off collection of audit records of the specified event type.

     satstate reports whether the audit subsystem is currently collecting or
     discarding records of the event type specified.

     To modify or query the audit state for every event type, call saton,
     satoff, or satstate repeatedly, once for each valid event type.

ERRORS
     saton, satoff and satstate fail if one or more of the following
     conditions are true:

     [ENOPKG]       Audit is not configured on this system.

     [EPERM]        The caller does not have CAP_AUDIT_CONTROL capability.

     [EDOM]         The specified audit event type is not valid.  Valid event
                    type numbers range from 1 to SAT_NTYPES-1, inclusive.

RETURN VALUE
     For satstate, a non-zero (positive) return value indicates that the audit
     subsystem is collecting records.  A return value of 0 indicates that the
     audit subsystem is discarding records.  A return value of -1 indicates an
     error and errno is set to indicate the error.

     For saton and satoff, a return value of -1 indicates an error and errno
     is set to indicate the error.  Otherwise 0 is returned.

SEE ALSO
     satread(2), satwrite(2)

ORIGIN
     Silicon Graphics, Inc.


                                                                        Page 1