Glossary

Audit Aware Programs

Privileged programs that invoke either the audswitch system call to suspend system call auditing or the audwrite system call to generate self-auditing events. Audit aware programs are also called self-auditing programs.

Audit Event

Also called an Audit Record. An event is an instance of a subject accessing an object. For example, a process opening a file or a user logging into a system. Audit records are generated when users make security-relevant system calls and when self-auditing processes call

audwrite(2).

Audit File

A file that stores audit records in binary format.

Audit Process Identifier (PID) Information Record (PIR)

An audit record written into the audit trail once for each process, containing information that remains constant throughout the lifetime of the process.

Audit Tag

A unique audit session ID that uniquely identifies (or tags) all audit records generated for a particular login session.

Audit Trail

All pieces of audit files that together store audit records in chronological order and provide a complete information trail for displaying or analysis.

On HP-UX 11i v2, an audit trail is a single audit file. On HP-UX 11i v3, an audit trail is composed of one or more audit files.

Base Event

A particular system operation that is audited and pre-defined by the HP-UX operating system. This is either a self-auditing event (for example, login) or a system call (for example, open).

Event Category

A set of base events that affect a particular aspect of the system (for example, the creation of an object, such as a file, directory, special device file, and IPC object.)

Filtering

Any one of the following types of audit filtering:

System call pre-filtering — Filtering of system call and self-audit events in the kernel based on process (user) and event selection flags, and performed before the system call specific code executes.

System call post-filtering — Filtering of system call events in the kernel based on the success or failure of system call, and performed after the system call specific code executes.

24