#
# Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
# Use is subject to license terms.
#
# ident	"@(
#

# skipClass=<class name of items to skip if only in that class>
#skipClass=no    

token=arg:argument
token=attr:attribute
token=cmd:command
token=data:data
token=group:group
token=inaddr:ip_addr
token=inet:socket
token=ipc:ipc
token=newgroup:newgroups
token=path:path
token=privset:privilege
token=proc:process
token=text:text
token=tid:terminal_adr
token=uauth:use_of_authorization
token=upriv:use_of_privilege
token=zone:zonename
token=label:mandatory_label

token=head:header
token=subj:subject
token=ret:return
token=exit:exit

message=ipc_perm:The ipc and ipc_perm tokens are not included if the message ID is not valid.

message=socket:The socket token for a bad socket is reported as "argument (1, "fd", socket descriptor)"

kernel=head:insert:subj:[upriv]:ret
user=head:subj:insert:ret

label=AUE_ACCEPT

  case=Invalid socket file descriptor
    format=arg1
      comment=1, file descriptor, "so"

  case=If the socket address is not part of the AF_INET family
    format=arg1:arg2:arg3
      comment=1, "so", file descriptor:
      comment="family", so_family:
      comment="type", so_type
  case=If the socket address is part of the AF_INET family
    case=...If there is no vnode for this file descriptor
      format=[arg]1
        comment=1, file descriptor, "Bad so"

    case=...or if the socket is not bound
      format=[arg]1:[inet]2
        comment=1, file descriptor, "so":
        comment=local/foreign address (0.0.0.0)
    case=...or if the socket address length = 0
      format=[arg]1:[inet]1
        comment=1, file descriptor, "so":
        comment=local/foreign address (0.0.0.0)
    case=...or for all other conditions
      format=inet1:[inet]1
        comment=socket address

label=AUE_ACCESS
  format=path1:[attr]
    comment=may be truncated in failure case

label=AUE_ACCT
  case=Zero path
    format=arg1
      comment=1, 0, "accounting off"
  case=Non-zero path
    format=path1:[attr]2
      comment=may be truncated in failure case:
      comment=omitted if failure

label=AUE_ACLSET
  syscall=acl
  format=arg1:arg2:(0..n)[acl]3
    comment=2, SETACL, "cmd":
    comment=3, number of ACL entries, "nentries":
    comment=Access Control List entries

label=AUE_ADJTIME
  format=kernel

label=AUE_ASYNC_DAEMON
  skip=Not used

label=AUE_ASYNC_DAEMON_EXIT
  skip=Not used

label=AUE_AUDIT
  skip=Not used.  (Placeholder for the set AUE_AUDIT_*.)

label=AUE_AUDITON
  skip=Not used.  (Placeholder for the set AUE_AUDITON_*.)

label=AUE_AUDITON_GESTATE
  skip=Not used

label=AUE_AUDITON_GETCAR
  format=kernel
  syscall=auditon: GETCAR

label=AUE_AUDITON_GETCLASS
  format=kernel
  syscall=auditon: GETCLASS

label=AUE_AUDITON_GETCOND
  format=kernel
  syscall=auditon: GETCOND

label=AUE_AUDITON_GETCWD
  format=kernel
  syscall=auditon: GETCWD

label=AUE_AUDITON_GETKMASK
  format=kernel
  syscall=auditon: GETKMASK

label=AUE_AUDITON_GETSTAT
  format=kernel
  syscall=auditon: A_GETSTAT

label=AUE_AUDITON_GPOLICY
  format=kernel
  syscall=auditon: GPOLICY

label=AUE_AUDITON_GQCTRL
  format=kernel
  syscall=auditon: GQCTRL

label=AUE_AUDITON_GTERMID
  skip=Not used.

label=AUE_AUDITON_SESTATE
  skip=Not used.

label=AUE_AUDITON_SETCLASS
  format=[arg]1:[arg]2
    comment=2, "setclass&colon;ec_event", event number:
    comment=3, "setclass&colon;ec_class", class mask
  syscall=auditon: SETCLASS

label=AUE_AUDITON_SETCOND
  format=[arg]1
    comment=3, "setcond", audit state
  syscall=auditon: SETCOND

label=AUE_AUDITON_SETKMASK
  format=[arg]1:[arg]2
    comment=2, "setkmask as_success", kernel mask:
    comment=2, "setkmask as_failure", kernel mask
  syscall=auditon: SETKMASK

label=AUE_AUDITON_SETSMASK
  format=[arg]1:[arg]2
    comment=3, "setsmask&colon;as_success", session ID mask:
    comment=3, "setsmask&colon;as_failure", session ID mask
  syscall=auditon: SETSMASK

label=AUE_AUDITON_SETSTAT
  format=kernel
  syscall=auditon: SETSTAT

label=AUE_AUDITON_SETUMASK
  format=[arg]1:[arg]2
    comment=3, "setumask&colon;as_success", audit ID mask:
    comment=3, "setumask&colon;as_failure", audit ID mask
  syscall=auditon: SETUMASK

label=AUE_AUDITON_SPOLICY
  format=[arg]1
    comment=1, audit policy flags, "setpolicy"
  syscall=auditon: SPOLICY

label=AUE_AUDITON_SQCTRL
  format=[arg]1:[arg]2:[arg]3:[arg]4
    comment=3, "setqctrl&colon;aq_hiwater", queue control param.:
    comment=3, "setqctrl&colon;aq_lowater", queue control param.:
    comment=3, "setqctrl&colon;aq_bufsz", queue control param.:
    comment=3, "setqctrl&colon;aq_delay", queue control param.
  syscall=auditon: SQCTRL

label=AUE_AUDITON_STERMID
  skip=Not used.

label=AUE_AUDITSTAT
  skip=Not used.

label=AUE_AUDITSVC

  case=With a valid file descriptor
    format=[path]:[attr]:[arg]1
      comment=3, limit, "limit"
  case=With an invalid file descriptor
    format=[arg]1:[arg]2
      comment=1, fd, "no path fd":
      comment=3, limit, "limit"

label=AUE_AUDITSYS
  skip=Not used. (Place holder for various auditing events.)

label=AUE_BIND

  case=Invalid socket handle
    format=arg1
      comment=1, file descriptor, "so"
  case=If there is no vnode for this file descriptor
    format=[arg]1
      comment=1, file descriptor, "Bad fd"
  case=or if the socket is not of the AF_INET family
    format=[arg]1:[text]2
      comment=1, file descriptor, "fd":
      comment=bad socket address
  case=or for all other conditions
    format=arg1:[arg]2:[arg]3:inet4
      comment=1, file descriptor, "so":
      comment=1, socket family, "family":
      comment=1, socket type, "type":
      comment=socket address

label=AUE_BRANDSYS

  format=arg1:arg2:arg3:arg4:arg5:arg6:arg7
    comment=1, command, "cmd":
    comment=2, command args, "arg":
    comment=3, command args, "arg":
    comment=4, command args, "arg":
    comment=5, command args, "arg":
    comment=6, command args, "arg":
    comment=7, command args, "arg":

label=AUE_BSMSYS
  skip=Not used.

label=AUE_CHDIR
  format=path:[attr]

label=AUE_CHMOD
  format=arg1:path:[attr]
    comment=2, mode, "new file mode"

label=AUE_CHOWN
  format=arg1:arg2
    comment=2, uid, "new file uid":
    comment=3, gid, "new file gid"

label=AUE_CHROOT
  format=path:[attr]

label=AUE_CLOSE
  format=arg1:[path]:[attr]
    comment=1, file descriptor, "fd"

label=AUE_CONNECT
  case=If the socket address is not part of the AF_INET family
    format=arg1:text2:text3
      comment=1, file descriptor, "so":
      comment=bad socket address:
      comment=bad peer address
  case=If the socket address is part of the AF_INET family
    case=...If there is no vnode for this file descriptor
      format=[arg]1
	comment=1, file descriptor, "bad fd"
    case=...or if the socket is not bound
      format=[arg]1:[text]2
	comment=1, file descriptor, "fd":
	comment=socket not bound
    case=...or if the socket address length = 0
      format=[arg]1:[text]2
	comment=1, file descriptor, "fd":
        comment=bad socket address
    case=...or for all other conditions
      format=[inet]1:inet1
	comment=socket address

label=AUE_CORE
  syscall=none
  title=process dumped core
  see=none
  format=path:[attr]:arg1
    comment=1, signal, "signal"

label=AUE_CREAT
  format=path:[attr]

label=AUE_DOORFS
  skip=Not used.  (Place holder for set of door audit events.)

label=AUE_DOORFS_DOOR_BIND

  format=kernel
  syscall=doorfs:  DOOR_BIND

label=AUE_DOORFS_DOOR_CALL
  format=arg1:proc2
    comment=1, door ID, "door ID":
    comment=for process that owns the door
  syscall=doorfs:  DOOR_CALL

label=AUE_DOORFS_DOOR_CREATE
  format=arg1
    comment=1, door attributes, "door attr"
  syscall=doorfs:  DOOR_CREATE

label=AUE_DOORFS_DOOR_CRED
  format=kernel
  syscall=doorfs:  DOOR_CRED

label=AUE_DOORFS_DOOR_INFO
  format=kernel
  syscall=doorfs:  DOOR_INFO

label=AUE_DOORFS_DOOR_RETURN
  format=kernel
  syscall=doorfs:  DOOR_RETURN

label=AUE_DOORFS_DOOR_REVOKE
  format=arg1
    comment=1, door ID, "door ID"
  syscall=doorfs:  DOOR_REVOKE

label=AUE_DOORFS_DOOR_UNBIND
  format=arg1
    comment=1, door ID, "door ID"
  syscall=doorfs:  DOOR_UNBIND

label=AUE_DUP2
skip=Not used.

label=AUE_ENTERPROM
  title=enter prom
  syscall=none
  format=head:text1:ret
    comment="kmdb"

label=AUE_EXEC
  format=path:[attr]1:[exec_arg]2:[exec_env]3
    comment=omitted on error:
    comment=output if argv policy is set:
    comment=output if arge policy is set

label=AUE_EXECVE
  format=path:[attr]1:[exec_arg]2:[exec_env]3
    comment=omitted on error:
    comment=output if argv policy is set:
    comment=output if arge policy is set

label=AUE_EXIT
  format=[text]1
    comment=event aborted

label=AUE_EXITPROM
  title=exit prom
  syscall=none
  format=head:text1:ret
    comment="kmdb"

label=AUE_EXPORTFS
  skip=Not used.

label=AUE_FACLSET
  syscall=facl
  case=Invalid file descriptor
    format=arg1:arg2
      comment=2, SETACL, "cmd":
      comment=3, number of ACL entries, "nentries":
  case=Zero path
    format=arg1:arg2:arg3:(0..n)[acl]4
      comment=2, SETACL, "cmd":
      comment=3, number of ACL entries, "nentries":
      comment=1, file descriptor, "no path  fd":
      comment=ACLs
  case=Non-zero path
    format=arg1:arg2:path:[attr]:(0..n)[acl]3
      comment=2, SETACL, "cmd":
      comment=3, number of ACL entries, "nentries":
      comment=ACLs

label=AUE_FCHDIR
  format=[path]:[attr]

label=AUE_FCHMOD
  case=With a valid file descriptor
    format=arg1:path:[attr]
      comment=2, mode, "new file mode":
  case=With an invalid file descriptor
    format=arg1:[arg]2
      comment=2, mode, "new file mode":
      comment=1, file descriptor, "no path  fd"

label=AUE_FCHOWN
  case=With a valid file descriptor
    format=arg1:arg2:[path]:[attr]
      comment=2, uid, "new file uid":
      comment=3, gid, "new file gid"
  case=With an invalid file descriptor
    format=arg1:arg2:[arg]3:[attr]
       comment=2, uid, "new file uid":
       comment=3, gid, "new file gid":
       comment=1, file descriptor, "no path fd"

label=AUE_FCHOWNAT
  see=openat(2)
  case=With a valid file descriptor
    format=arg1:arg2:[path]:[attr]
      comment=2, uid, "new file uid":
      comment=3, gid, "new file gid"
  case=With an invalid file descriptor
    format=arg1:arg2:[arg]3:[attr]
       comment=2, uid, "new file uid":
       comment=3, gid, "new file gid":
       comment=1, file descriptor, "no path fd"

label=AUE_FCHROOT
  format=[path]:[attr]

label=AUE_FCNTL
  case=With a valid file descriptor
    format=arg1:path:attr
      comment=2, command, "cmd"
  case=With an invalid file descriptor
    format=arg1:arg2
      comment=2, command, "cmd":
      comment=1, file descriptor, "no path fd"

label=AUE_FLOCK
  skip=Not used.

label=AUE_FORK
  format=[arg]1
    comment=0, pid, "child PID"
  note=The fork(2) return values are undefined because the audit record 
  note=is produced at the point that the child process is spawned.

label=AUE_FORK1
  format=[arg]1
    comment=0, pid, "child PID"
  note=The fork1(2) return values are undefined because the audit record 
  note=is produced at the point that the child process is spawned.

label=AUE_FSAT
  skip=Not used.  (Placeholder for AUE_*AT records)

label=AUE_FSTAT
  skip=Not used.

label=AUE_FSTATAT

label=AUE_FSTATFS
  case=With a valid file descriptor
    format=[path]:[attr]
  case=With an invalid file descriptor
    format=arg1
      comment=1, file descriptor, "no path fd"

label=AUE_FTRUNCATE
  skip=Not used.

label=AUE_FUTIMESAT

label=AUE_GETAUDIT
  format=kernel

label=AUE_GETAUDIT_ADDR
  format=kernel

label=AUE_GETAUID
  format=kernel

label=AUE_GETDENTS
  skip=Not used.

label=AUE_GETKERNSTATE
  skip=Not used.

label=AUE_GETMSG
  format=arg1:arg2
    comment=1, file descriptor, "fd":
    comment=4, priority, "pri"

label=AUE_GETPMSG
  format=arg1
    comment=1, file descriptor, "fd"

label=AUE_GETPORTAUDIT
  format=kernel

label=AUE_GETUSERAUDIT
  skip=Not used.

label=AUE_INST_SYNC
  format=arg1
    comment=2, flags value, "flags"

label=AUE_IOCTL
  case=With an invalid file descriptor
    format=arg1:arg2:arg3
      comment=1, file descriptor, "fd":
      comment=2, command, "cmd":
      comment=3, arg, "arg"
  case=With a valid file descriptor
    format=path:[attr]:arg1:arg2
      comment=2, ioctl cmd, "cmd":
      comment=3, ioctl arg, "arg"
  case=Socket
    format=[socket]:arg1:arg2
      comment=2, ioctl cmd, "cmd":
      comment=3, ioctl arg, "arg"
  case=Non-file file descriptor
    format=arg1:arg2:arg3
      comment=1, file descriptor, "fd":
      comment=2, ioctl cmd, "cmd":
      comment=3, ioctl arg, "arg"
  case=Bad file name
    format=arg1:arg2:arg3
      comment=1, file descriptor, "no path&colon; fd":
      comment=2, ioctl cmd, "cmd":
      comment=3, ioctl arg, "arg"

label=AUE_JUNK
  skip=Not used.

label=AUE_KILL
  case=Valid process
    format=arg1:[proc]
      comment=2, signo, "signal"
  case=Zero or negative process
    format=arg1:arg2
      comment=2, signo, "signal":
      comment=1, pid, "process"

label=AUE_KILLPG
  skip=Not used.

label=AUE_LCHOWN
  format=arg1:arg2:path:[attr]
    comment=2, uid, "new file uid":
    comment=3, gid, "new file gid"

label=AUE_LINK
  format=path1:[attr]2:path3
     comment=from path:from path:to path

label=AUE_LSEEK
  skip=Not used.

label=AUE_LSTAT
  format=path:[attr]

label=AUE_LXSTAT
  skip=Not used.

label=AUE_MCTL
  skip=Not used.

label=AUE_MEMCNTL
  format=arg1:arg2:arg3:arg4:arg5:arg6
    comment=1, base address, "base":
    comment=2, length, "len":
    comment=3, command, "cmd":
    comment=4, command args, "arg":
    comment=5, command attributes, "attr":
    comment=6, 0, "mask"

label=AUE_MKDIR
  format=arg1:path
    comment=2, mode, "mode"

label=AUE_MKNOD
  format=arg1:arg2:path:[attr]
    comment=2, mode, "mode":
    comment=3, dev, "dev"

label=AUE_MMAP
  case=With a valid file descriptor
    format=arg1:arg2:[path]:[attr]
      comment=1, segment address, "addr":
      comment=2, segment address, "len"
  case=With an invalid file descriptor
    format=arg1;arg2:arg3
      comment=1, segment address, "addr":
      comment=2, segment address, "len":
      comment=1, file descriptor, "no path&colon; fd"

label=AUE_MODADDMAJ
  title=modctl: bind module
  syscall=modctl
  format=[text]1:[text]2:text3:text4:arg5:(0..n)[text]6
    comment=driver major number:
    comment=driver name:
    comment=root directory or "no rootdir":
    comment=driver major number or "no drvname":
    comment=5, number of aliases, "":
    comment=aliases

label=AUE_MODCONFIG
  syscall=modctl
  title=modctl: configure module
  format=text1:text2
    comment=root directory or "no rootdir":
    comment=driver major number or "no drvname"

label=AUE_MODCTL
  format=kernel

label=AUE_MODLOAD
  syscall=modctl
  title=modctl: load module
  format=[text]1:text2
    comment=default path:
    comment=filename path

label=AUE_MODUNLOAD
  syscall=modctl
  title=modctl: unload module
  format=arg1
    comment=1, module ID, "id"

label=AUE_MOUNT
  case=UNIX file system
    format=arg1:text2:path:[attr]:[path]:[attr]
      comment=3, flags, "flags":
      comment=filesystem type
  case=NFS file system
    format=arg1:text2:text3:arg4:path:[attr]
      comment=3, flags, "flags":
      comment=filesystem type:
      comment=host name:
      comment=3, flags, "internal flags"

label=AUE_MSGCTL
  format=arg1:[ipc]
    comment=1, message ID, "msg ID"
  note=ipc_perm

label=AUE_MSGCTL_RMID
  format=arg1:[ipc]
    comment=1, message ID, "msg ID"
  note=ipc_perm
  syscall=msgctl: IPC_RMID

label=AUE_MSGCTL_SET
  format=arg1:[ipc]
    comment=1, message ID, "msg ID"
  note=ipc_perm
  syscall=msgctl: IPC_SET

label=AUE_MSGCTL_STAT
  format=arg1:[ipc]
    comment=1, message ID, "msg ID"
  note=ipc_perm
  syscall=msgctl: IPC_STAT

label=AUE_MSGGET
  format=arg1:[ipc]
    comment=1, message key, "msg key"
  note=ipc_perm

label=AUE_MSGGETL
  skip=Not used.

label=AUE_MSGRCV
  format=arg1:[ipc]
    comment=1, message ID, "msg ID"
  note=ipc_perm

label=AUE_MSGRCVL
  skip=Not used.

label=AUE_MSGSND
  format=arg1:[ipc]
    comment=1, message ID, "msg ID"
  note=ipc_perm

label=AUE_MSGSNDL
  skip=Not used.

label=AUE_MSGSYS
skip=Not used.  (Placeholder for AUE_MSG* events.)

label=AUE_MUNMAP
  format=arg1:arg2
    comment=1, address of memory, "addr":
    comment=2, memory segment size, "len"

label=AUE_NFS
  skip=Not used.

label=AUE_NFSSVC_EXIT
  skip=Not used.

label=AUE_NFS_GETFH
  skip=Not used.

label=AUE_NFS_SVC
  skip=Not used.

label=AUE_NICE
  format=kernel

label=AUE_NULL
  skip=Not used.  (placeholder)

label=AUE_ONESIDE
  skip=Not used.

label=AUE_OPEN
  skip=Not used.  (placeholder for AUE_OPEN_*).

label=AUE_OPEN_R
  format=path:[attr]
  see=open(2) - read

label=AUE_OPENAT_R
  format=path:[attr]
  see=openat(2)

label=AUE_OPEN_RC
  format=path:[attr]
  see=open(2) - read,creat

label=AUE_OPENAT_RC
  see=openat(2)
  format=path:[attr]

label=AUE_OPEN_RT
  format=path:[attr]
  see=open(2) - read,trunc

label=AUE_OPENAT_RT
  see=openat(2)
  format=path:[attr]

label=AUE_OPEN_RTC
  format=path:[attr]
  see=open(2) - read,trunc,creat

label=AUE_OPENAT_RTC
  see=openat(2)
  format=path:[attr]

label=AUE_OPEN_RW
  format=path:[attr]
  see=open(2) - read,write

label=AUE_OPENAT_RW
  see=openat(2)
  format=path:[attr]

label=AUE_OPEN_RWC
  format=path:[attr]
  see=open(2) - read,write,creat

label=AUE_OPENAT_RWC
  see=openat(2)
  format=path:[attr]

label=AUE_OPEN_RWT
  format=path:[attr]
  see=open(2) - read,write,trunc

label=AUE_OPENAT_RWT
  see=openat(2)
  format=path:[attr]

label=AUE_OPEN_RWTC
  format=path:[attr]
  see=open(2) - read,write,trunc,creat

label=AUE_OPENAT_RWTC
  see=openat(2)
  format=path:[attr]

label=AUE_OPEN_W
  format=path:[attr]
  see=open(2) - write

label=AUE_OPENAT_W
  see=openat(2)
  format=path:[attr]

label=AUE_OPEN_WC
  format=path:[attr]
  see=open(2) - write,creat

label=AUE_OPENAT_WC
  see=openat(2)
  format=path:[attr]

label=AUE_OPEN_WT
  format=path:[attr]
  see=open(2) - write,trunc

label=AUE_OPENAT_WT
  see=openat(2)
  format=path:[attr]

label=AUE_OPEN_WTC
  format=path:[attr]
  see=open(2) - write,trunc,creat

label=AUE_OPENAT_WTC
  see=openat(2)
  format=path:[attr]

label=AUE_OSETPGRP
  skip=Not used.

label=AUE_OSETUID
  skip=Not used.
  syscall=old setuid

label=AUE_OSTAT
  skip=Not used.

label=AUE_PATHCONF
  format=path:[attr]

label=AUE_PIPE
format=kernel

label=AUE_PRIOCNTLSYS
  syscall=priocntl
  see=priocntl(2)
  format=arg1:arg2
    comment=1, priocntl version number, "pc_version":
    comment=3, command, "cmd"

label=AUE_PROCESSOR_BIND
  case=No threads bound to the processor
    format=arg1:arg2:text3:[proc]
      comment=1, type of ID, "ID type":
      comment=2, ID value, "ID":
      comment="PBIND_NONE"
  case=With processor bound
    format=arg1:arg2:arg3:{proc]
      comment=1, type of ID, "ID type":
      comment=2, ID value, "ID":
      comment=3, processor ID, "processor_id"

label=AUE_PUTMSG
  format=arg1:arg2
    comment=1, file descriptor, "fd":
    comment=4, priority, "pri"

label=AUE_PUTPMSG
see=putmsg(2)

  format=arg1:arg2:arg3
    comment=1, file descriptor, "fd":
    comment=4, priority, "pri":   
    comment=5, flags, "flags"

label=AUE_P_ONLINE
  format=arg1:arg2:text3
    comment=1, processor ID, "processor ID":
    comment=2, flags value, "flags":
    comment=text form of flags.  Values&colon;  P_ONLINE, P_OFFLINE, P_NOINTR, P_SPARE, P_FAULTED, P_STATUS

label=AUE_QUOTACTL
  skip=Not used.

label=AUE_READ
  skip=Not used.  (Placeholder for AUE_READ_* events)

label=AUE_READL
  skip=Not used. (Obsolete)

label=AUE_READLINK
  format=path:[attr]

label=AUE_READV
  skip=Not used (obsolete)

label=AUE_READVL
  skip=Not used (obsolete)

label=AUE_REBOOT
  skip=Not used.

label=AUE_RECV
  format=arg1:[arg]2:[arg]3:[inet]
    comment=1, file descriptor, "so":
    comment=1, family, "family":
    comment=1, type, "type"

label=AUE_RECVFROM
  format=inet:arg1:[arg2]:inet3:arg4
    comment=3, message length, "len":
    comment=4, flags, "flags":
    comment=from address:
    comment=6, address length, "tolen"
  note=The socket token for a bad socket is reported as "argument 
  note=token (1, socket descriptor, "fd")"

label=AUE_RECVMSG
  format=inet:arg1:inet2:arg3
    comment=4, flags, "flags":
    comment=from address:
    comment=6, address length, "tolen"
  note=The socket token for a bad socket is reported as 'argument 
  note=token (1, "fd", socket descriptor)'

label=AUE_RENAME
  format=path1:[attr]1:[path]2
  comment=from name:to name:

label=AUE_RENAMEAT
  see openat(2)
  format=path1:[attr]1:[path]2
  comment=from name:to name:

label=AUE_RFSSYS
  skip=Not used.

label=AUE_RMDIR
  format=path:[attr]

label=AUE_SEMCTL
  format=arg1:[ipc]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm

label=AUE_SEMCTL_GETALL
  format=arg1:[ipc]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: GETALL

label=AUE_SEMCTL_GETNCNT
  format=arg1:[ipc]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: GETNCNT

label=AUE_SEMCTL_GETPID
  format=arg1:[ipc]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: GETPID

label=AUE_SEMCTL_GETVAL
  format=arg1:[ipc]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: GETVAL

label=AUE_SEMCTL_GETZCNT
  format=arg1:[ipc]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: GETZCNT

label=AUE_SEMCTL_RMID
  format=arg1:[ipc]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: IPC_RMID

label=AUE_SEMCTL_SET
  format=arg1:[ipc]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: IPC_SET

label=AUE_SEMCTL_SETALL
  format=arg1:[ipc]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: SETALL

label=AUE_SEMCTL_SETVAL
  format=arg1:[ipc]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: SETVAL

label=AUE_SEMCTL_STAT
  format=arg1:[ipc]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: IPC_STAT

label=AUE_SEMGET
  format=arg1:[ipc]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm
  syscall=semctl: SETVAL

label=AUE_SEMGETL
  skip=Not used.

label=AUE_SEMOP
  format=arg1:[ipc]
    comment=1, semaphore ID, "sem ID"
  note=ipc_perm

label=AUE_SEMSYS
  skip=Not used.  (place holder) -- defaults to a semget variant

label=AUE_SEND
  format=kernel

label=AUE_SENDMSG
  case=If invalid file descriptor
    format=arg1:arg2
      comment=1, file descriptor, "so":
      comment=3, flags, "flags"
  case=If valid file descriptor
  case=...and socket is AF_UNIX
    format=path1:arg2:[arg]3:[arg]4:[arg]5
      comment=if no path, will be argument&colon; 1, "nopath&colon; fd", file descriptor:
      comment=1, file descriptor, "so":
      comment=1, family, "family":
      comment=1, type, "type":
      comment=3, message flags, "flags"
  case=...and socket is AF_INET or AF_INET6
    format=arg1:[arg]2:[arg]3:[arg]4
      comment=1, file descriptor, "so":
      comment=1, family, "family":
      comment=1, type, "type":
      comment=3, message flags, "flags"

label=AUE_SENDTO
  case=If invalid file descriptor
    format=arg1:arg2
      comment=1, file descriptor, "so":
      comment=3, flags, "flags"
  case=If valid file descriptor
  case=...and socket is AF_UNIX
    format=path1:arg2:[arg]3:[arg]4:[arg]5
      comment=if no path, will be argument&colon; 1, file descriptor, "nopath&colon; fd":
      comment=1, file descriptor, "so":
      comment=1, family, "family":
      comment=1, type, "type":
      comment=3, message flags, "flags"
  case=...and socket is AF_INET or AF_INET6
    format=arg1:[arg]2:[arg]3:[arg]4
      comment=1, file descriptor, "so":
      comment=1, family, "family":
      comment=1, type, "type":
      comment=3, message flags, "flags"

label=AUE_SETAUDIT
  case=With a valid program stack address
    format=arg1:arg2:arg3:arg4:arg5:arg6
      comment=1, audit user ID, "setaudit&colon;auid":
      comment=1, terminal ID, "setaudit&colon;port":
      comment=1, terminal ID, "setaudit&colon;machine":
      comment=1, preselection mask, "setaudit&colon;as_success":
      comment=1, preselection mask, "setaudit&colon;as_failure":
      comment=1, audit session ID, "setaudit&colon;asid"
  case=With an invalid program stack address
    format=kernel

label=AUE_SETAUDIT_ADDR
  case=With a valid program stack address
    format=arg1:arg2:arg3:ip address4:arg5:arg6:arg7
      comment=1, audit user ID, "auid":
      comment=1, terminal ID, "port":
      comment=1, type, "type":
      comment=1, terminal ID, "ip address":
      comment=1, preselection mask, "as_success":
      comment=1, preselection mask, "as_failure":
      comment=1, audit session ID, "asid"
  case=With an invalid program stack address
    format=kernel

label=AUE_SETAUID
  format=arg1
    comment=2, audit user ID, "setauid"

label=AUE_SETDOMAINNAME
  skip=Not used.  (See AUE_SYSINFO)

label=AUE_SETEGID
  format=arg1
    comment=1, group ID, "gid"

label=AUE_SETEUID
  format=arg1
    comment=1, user ID, "euid"

label=AUE_SETGID
  format=arg1
    comment=1, group ID, "gid"

label=AUE_SETGROUPS
  case=If no groups in list
    format=[arg]1
      comment=1, 0, "setgroups"
  case=If 1 or more groups in list
    format=(1..n)arg1
      comment=1, gid, "setgroups"

label=AUE_SETHOSTNAME
  skip=Not used.  (See AUE_SYSINFO)

label=AUE_SETKERNSTATE
  skip=Not used.

label=AUE_SETPGRP
  format=[proc]:[arg]1
    comment=2, pgrp, "pgrp"

label=AUE_SETPRIORITY
  skip=Not used.

label=AUE_SETPPRIV
  case=operation privileges off
  format=arg1,privset2
    comment=setppriv operation:
    comment=privileges actually switched off
  case=operation privileges on
  format=arg1,privset2
    comment=setppriv operation:
    comment=privileges actually switched on
  case=operation privileges off
  format=arg1,privset,privset
    comment=setppriv operation:
    comment=privileges before privset:
    comment=privileges after privset

label=AUE_SETREGID
  format=arg1:arg2
    comment=1, real group ID, "rgid":
    comment=2, effective group ID, "egid"

label=AUE_SETREUID
  format=arg1:arg2
    comment=1, real user ID, "ruid":
    comment=2, effective user ID, "euid"

label=AUE_SETRLIMIT
  format=kernel

label=AUE_SETSOCKOPT
  case=Invalid file descriptor
    format=arg1:arg2
      comment=1, file descriptor, "so":
      comment=3, flags, "flags"
  case=Valid file descriptor
  case=...and socket is AF_UNIX
    format=path1:arg2:[arg]3:[arg]4:arg5:arg6:arg7:data8:inet
      comment=if no path, will be argument&colon; 1, "nopath&colon; fd", file descriptor:
      comment=1, file descriptor, "so":
      comment=1, family, "family":
      comment=1, type, "type":
      comment=2, protocol level, "level":
      comment=3, option name, "optname":
      comment=5, option length, "optlen":
      comment=option data
  case=...and socket is AF_INET or AF_INET6
    format=arg1:[arg]2:[arg]3:arg4:arg5:arg6:data7:inet
      comment=1, file descriptor, "so":
      comment=1, family, "family":
      comment=1, type, "type":
      comment=2, protocol level, "level":
      comment=3, option name, "optname":
      comment=5, option length, "optlen":
      comment=option data

label=AUE_SETTIMEOFDAY
  skip=Not used.

label=AUE_SETUSERAUDIT
  skip=Not used.

label=AUE_SHMAT
  format=arg1:arg2:[ipc]:[ipc_perm]
    comment=1, shared memory ID, "shm ID":
    comment=2, shared mem addr, "shmaddr"
  note=ipc_perm

label=AUE_SHMCTL
  format=arg1:[ipc]
    comment=1, shared memory ID, "shm ID"
  note=ipc_perm

label=AUE_SHMCTL_RMID
  format=arg1:[ipc]:ipc_perm
  comment=1, shared memory ID, "shm ID":
  note=ipc_perm
  syscall=semctl:  IPC_RMID

label=AUE_SHMCTL_SET
  format=arg1:[ipc]:[ipc_perm]
    comment=1, shared memory ID, "shm ID":
  note=ipc_perm
  syscall=semctl:  IPC_SET

label=AUE_SHMCTL_STAT
  format=arg1:[ipc]
    comment=1, shared memory ID, "shm ID":
  note=ipc_perm
  syscall=semctl:  IPC_STAT

label=AUE_SHMDT
  format=arg1
    comment=1, shared memory address, "shm adr"

label=AUE_SHMGET
  format=arg1:[ipc_perm]:[ipc]
    comment=0, shared memory key, "shm key"
  note=ipc_perm

label=AUE_SHMGETL
  skip=Not used.

label=AUE_SHMSYS
  skip=Not used.  (Placeholder for shmget and shmctl*)

label=AUE_SHUTDOWN
  case=If the socket address is invalid
    format=[arg]1:[text]2:[text]3
      comment=1, file descriptor, "fd":
      comment=bad socket address:bad peer address
  case=If the socket address is part of the AF_INET family
    case=..with zero file descriptor
      format=arg1:[arg]2:[arg]3:[arg]4
	comment=1, file descriptor, "so":
	comment=1, family, "family":
	comment=1, type, "type":
	comment=2, how shutdown code, "how"
    case=...with non-zero file descriptor
      format=arg1,arg2,inet
	comment=1, file descriptor, "so":
	comment=2, how shutdown code, "how"
  case=If the socket address is AF_UNIX
    case=...with zero file descriptor
      format=path1:arg2:[arg]3:[arg]4:[arg]5
	comment=If error&colon; argument&colon; 1, "no path&colon; fd", file descriptor:
	comment=1, file descriptor, "so":
	comment=1, family, "family":
	comment=1, type, "type":
	comment=2, how shutdown code, "how"
    case=...with non-zero file descriptor
      format=path1:arg2:arg3:inet
	comment=If error&colon; argument&colon; 1, file descriptor, "no path&colon; fd":
	comment=1, file descriptor, "so":
	comment=2, how shutdown code, "how"

label=AUE_SOCKACCEPT
  syscall=getmsg:  socket accept
  format=inet:arg1:[path]:attr:arg2
    comment=1, file descriptor, "fd":
    comment=4, priority, "pri"

label=AUE_SOCKCONFIG
  format=arg1:arg2:arg3:[path]4
    comment=1, domain address, "domain":
    comment=2, type, "type":
    comment=3, protocol, "protocol":
    comment=If no path&colon;argument -- 3, 0, "devpath"

label=AUE_SOCKCONNECT
  syscall=putmsg:  socket connect
  format=inet:arg1:[path]:attr:arg2
    comment=1, file descriptor, "fd":
    comment=4, priority, "pri"

label=AUE_SOCKET
  format=arg1:[arg]2:arg3
    comment=1, socket domain, "domain":
    comment=2, socket type, "type":
    comment=3, socket protocol, "protocol"

label=AUE_SOCKETPAIR
  skip=Not used.

label=AUE_SOCKRECEIVE
  syscall=getmsg
  format=inet:arg1:[path]:attr:arg
    comment=1, file descriptor, "fd":
    comment=4, priority, "pri"

label=AUE_SOCKSEND
syscall=putmsg
  format=inet:arg1:[path]:attr:arg
    comment=1, file descriptor, "fd":
    comment=4, priority, "pri"

label=AUE_STAT
  format=path:[attr]

label=AUE_STATFS
  format=path:[attr]

label=AUE_STATVFS
  format=path:[attr]

label=AUE_STIME
  format=kernel

label=AUE_SWAPON
  skip=Not used.

label=AUE_SYMLINK
  format=text1:path:[attr]
    comment=symbolic link string

label=AUE_SYSINFO
  format=arg1:[text]2
    comment=1, command, "cmd":name

label=AUE_SYSTEMBOOT
  title=system booted
  syscall=none
  format=head:text1
    comment="booting kernel"

label=AUE_TRUNCATE
  skip=Not used.

label=AUE_UMOUNT
  syscall=umount: old version
  format=path:[attr]

label=AUE_UMOUNT2
  syscall=umount2
  format=path:arg1:[path]:[attr]
    comment=2, mflag value, "flags"

label=AUE_UNLINK
  format=path:[attr]

label=AUE_UNLINKAT
  see=openat(2)
  format=path:[attr]

label=AUE_UNMOUNT
  skip=Not used.

label=AUE_UTIME
  format=path:[attr]

label=AUE_UTIMES
  format=path:[attr]

label=AUE_UTSSYS
  skip=Not used.

label=AUE_VFORK
  format=arg1
    comment=0, pid, "child PID"
  note=The vfork(2) return values are undefined because the audit record is 
  note=produced at the point that the child process is spawned.

label=AUE_VPIXSYS
  skip=Not used.

label=AUE_VTRACE
  format=kernel

label=AUE_WRITE
  format=path1:attr
    comment=if no path, argument -- "1, file descriptor, "no path: fd"
  note:An audit record is generated for write only once per file close.

label=AUE_WRITEV
  skip=Not used. (obsolete)

label=AUE_WRITEL
  skip=Not used. (obsolete)

label=AUE_WRITEVL
  skip=Not used. (obsolete)

label=AUE_XMKNOD
  skip=Not used.  xmknod() generates AUE_MKNOD

label=AUE_XSTAT
  skip=Not Used.  xstat() generates AUE_STAT.

label=AUE_admin_authenticate
  program=admin (various)
  see=SMC, WBEM, or AdminSuite
  title=Admin Server Authentication
  format=[text]1
    comment="successful login" or error message

label=AUE_PF_POLICY_ADDRULE
  title=Add IPsec policy rule
  see=
  syscall=none
  format=arg1:arg2:[zone]3:[text]4
  comment=Operation applied to active policy (1 is active, 0 is inactive):
  comment=Operation applied to global policy (1 is global, 0 is tunnel):
  comment=affected zone:
  comment=Name of target tunnel

label=AUE_PF_POLICY_DELRULE
  title=Delete IPsec policy rule
  see=
  syscall=none
  format=arg1:arg2:[zone]3:[text]4
  comment=Operation applied to active policy (1 is active, 0 is inactive):
  comment=Operation applied to global policy (1 is global, 0 is tunnel):
  comment=affected zone:
  comment=Name of target tunnel

label=AUE_PF_POLICY_CLONE
  title=Clone IPsec policy
  see=
  syscall=none
  format=arg1:arg2:[zone]3:[text]4
  comment=Operation applied to active policy (1 is active, 0 is inactive):
  comment=Operation applied to global policy (1 is global, 0 is tunnel):
  comment=affected zone:
  comment=Name of target tunnel

label=AUE_PF_POLICY_FLIP
  title=Flip IPsec policy
  see=
  syscall=none
  format=arg1:arg2:[zone]3:[text]4
  comment=Operation applied to active policy (1 is active, 0 is inactive):
  comment=Operation applied to global policy (1 is global, 0 is tunnel):
  comment=affected zone:
  comment=Name of target tunnel

label=AUE_PF_POLICY_FLUSH
  title=Flip IPsec policy rules
  see=
  syscall=none
  format=arg1:arg2:[zone]3:[text]4
  comment=Operation applied to active policy (1 is active, 0 is inactive):
  comment=Operation applied to global policy (1 is global, 0 is tunnel):
  comment=affected zone:
  comment=Name of target tunnel

label=AUE_PF_POLICY_ALGS
  title=Update IPsec algorithms
  see=
  syscall=none
  format=arg1:arg2:[zone]3:[text]4
  comment=Operation applied to active policy (1 is active, 0 is inactive):
  comment=Operation applied to global policy (1 is global, 0 is tunnel):
  comment=affected zone:
  comment=Name of target tunnel

label=AUE_allocate_fail
  program=/usr/sbin/allocate
  title=allocate: allocate-device failure
  format=(0..n)[text]1
    comment=command line arguments

label=AUE_allocate_succ
  program=/usr/sbin/allocate
  title=allocate: allocate-device success
  format=(0..n)[text]1
    comment=command line arguments

label=AUE_at_create
  program=/usr/bin/at
  title=at: at-create crontab
  format=user

label=AUE_at_delete
  program=/usr/bin/at
  title=at: at-delete atjob (at or atrm)
  format=text1:path
  comment=""ancillary file&colon;" filename or "bad format of at-job name"

label=AUE_at_perm
  skip=Not used.

label=AUE_create_user
  program=administration: create user
  format=text1:text2:text3:text4:text5:text6:text7:text8:text9:text10:text11:text12:text13:text14
    comment=uid:
    comment=user name:
    comment=primary gid:
    comment=secondary gids; blank if none:
    comment=login shell:
    comment=password type:
    comment=min change:
    comment=max change:
    comment=max inactive:
    comment=expiration date:
    comment=warning:
    comment=path:
    comment=server:
    comment=permissions

label=AUE_cron_invoke
  program=/usr/sbin/cron
  title=cron: cron-invoke at or cron
  format=text1:[text]2:[text3]:text4
    comment="at-job", "batch-job", "crontab-job", "queue-job", or "unknown job type":
    comment="bad user" name or "user <name> account expired":
    comment=shell:
    comment=cmd

label=AUE_crontab_create
  program=/usr/bin/crontab
  title=crontab: crontab created
  format=[text]1:path
  comment=crontab content

label=AUE_crontab_delete
  program=/usr/bin/crontab
  title=crontab: crontab delete
  format=path

label=AUE_crontab_mod
  program=/usr/bin/crontab
  title=crontab:  crontab modify
  format=[text]1:path
  comment=crontab diffs

label=AUE_crontab_perm
  skip=Not used.

label=AUE_deallocate_fail
  program=/usr/sbin/deallocate
  title=deallocate-device failure
  format=(0..n)[text]1
    comment=command line arguments

label=AUE_deallocate_succ
  program=/usr/sbin/deallocate
  title=deallocate-device success
  format=(0..n)[text]1
    comment=command line arguments

label=AUE_delete_user
  program=administration: delete user
  format=text1
    comment=uid

label=AUE_disable_user
  program=administration: disable user
  format=text1
    comment=uid

label=AUE_enable_user
  program=administration: enable user
  format=text1
    comment=uid

label=AUE_ftpd
  program=/usr/sbin/in.ftpd
  title=in.ftpd
  format=[text]1
    comment=error message

label=AUE_ftpd_logout
  program=/usr/sbin/in.ftpd
  title=in.ftpd
  format=text

label=AUE_filesystem_add
  program=SMC server
  see=
  title=SMC: filesystem add
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=initial values

label=AUE_filesystem_modify
  program=SMC server
  see=
  title=SMC: filesystem modify
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=changed values

label=AUE_filesystem_delete
  program=SMC server
  see=
  title=SMC: filesystem delete
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=deleted values

label=AUE_halt_solaris
  program=/usr/sbin/halt
  title=halt
  format=user

label=AUE_inetd_connect
  program=/usr/sbin/inetd
  title=inetd
  format=text1:tid2:cmd3:privset
  comment=service name:client address:inetd command

label=AUE_inetd_ratelimit
  program=/usr/sbin/inetd
  title=inetd
  format=text1:text2
  comment=service name:limit value

label=AUE_inetd_copylimit
  program=/usr/sbin/inetd
  title=inetd
  format=text1:text2
  comment=service name:limit value

label=AUE_inetd_failrate
  program=/usr/sbin/inetd
  title=inetd
  format=text1:text2
  comment=service name:limit value, interval

label=AUE_init_solaris
  title=init
  see=init(1M)
  program=/sbin/init;/usr/sbin/init;/usr/sbin/shutdown
  format=text1
  comment=init level or zone name

label=AUE_kadmind_auth
  format=text1:text2:text3
    comment=Op&colon; <requested information>:
    comment=Arg&colon; <argument for Op>:
    comment=Client&colon; <client principal name>

label=AUE_kadmind_unauth
  format=text1:text2:text3
    comment=Op&colon; <requested information>:
    comment=Arg&colon; <argument for Op>:
    comment=Client&colon; <client principal name>

label=AUE_krb5kdc_as_req
  format=text1:text2
    comment=Client&colon; <client principal name>:
    comment=Service&colon; <requested service name>

label=AUE_krb5kdc_tgs_req
  format=text1:text2
    comment=Client&colon; <client principal name>:
    comment=Service&colon; <requested service name>

label=AUE_krb5kdc_tgs_req_alt_tgt
  format=text1:text2
    comment=Client&colon; <client principal name>:
    comment=Service&colon; <requested service name>

label=AUE_krb5kdc_tgs_req_2ndtktmm
  format=text1:text2
    comment=Client&colon; <client principal name>:
    comment=Service&colon; <requested service name>

label=AUE_listdevice_fail
  title=allocate-list devices failure
  program=/usr/sbin/allocate
  format=(0..n)[text]1
    comment=command line arguments

label=AUE_listdevice_succ
  title=allocate-list devices success
  program=/usr/sbin/allocate
  format=(0..n)[text]1
    comment=command line arguments

label=AUE_login
  title=terminal login
  program=/usr/sbin/login;/usr/dt/bin/dtlogin
  see=login(1);dtlogin
  format=text1
  comment=error message or "successful login"

label=AUE_logout
  title=login: logout
  program=various
  see=login(1)
  format=text1
  comment="logout" username

label=AUE_modify_user
  program=administration: modify user
  format=text1:text2:text3:text4:text5:text6:text7:text8:text9:text10:text11:text12:text13:text14
    comment=uid:
    comment=user name:
    comment=primary gid:
    comment=secondary gids; blank if none:
    comment=login shell:
    comment=password type:
    comment=min change:
    comment=max change:
    comment=max inactive:
    comment=expiration date:
    comment=warning:
    comment=path:
    comment=server:
    comment=permissions

label=AUE_mountd_mount
  title=mountd: NFS mount
  program=/usr/lib/nfs/mountd
  see=mountd(1M)
  format=text1:path2
    comment=remote client hostname:mount dir

label=AUE_mountd_umount
  title=mountd: NFS unmount
  program=/usr/lib/nfs/mountd
  format=path1
  comment=mount dir

label=AUE_network_add
  program=SMC server
  see=
  title=SMC: network add
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=initial values

label=AUE_network_modify
  program=SMC server
  see=
  title=SMC: network modify
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=changed values

label=AUE_network_delete
  program=SMC server
  see=
  title=SMC: network delete
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=deleted values

label=AUE_newgrp_login
  program=newgrp
  format=text1
    comment=User id

label=AUE_passwd
  program=/usr/bin/passwd
  title=passwd
  format=text1
    comment=success/fail message

label=AUE_printer_add
  see=
  program=SMC server
  title=SMC: printer add
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=initial values

label=AUE_printer_modify
  see=
  program=SMC server
  title=SMC: printer modify
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=changed values

label=AUE_printer_delete
  program=SMC server
  see=
  title=SMC: printer delete
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=deleted values

label=AUE_poweroff_solaris
  program=/usr/sbin/poweroff
  title=poweroff
  format=user

label=AUE_prof_cmd
  program=/usr/bin/pfexec
  see=pfexec(1)
  title=pfexec
  format=[newgroup]:path1:path2:cmd:process:[privset]:[privset]
  comment=working directory:
  comment=command pathname

label=AUE_reboot_solaris
  program=/usr/sbin/reboot
  title=reboot
  format=user

label=AUE_rexd
  program=/usr/sbin/rpc.rexd
  title=rpc.rexd
  format=[text]1:text2:text3:[text]4:text5
    comment=error message (failure only):
    comment="Remote execution requested by&colon;" hostname:
    comment="Username&colon;" username:
    comment="User id&colon;" user ID (failure only):
    comment="Command line&colon;" command attempted

label=AUE_rexecd
  program=/usr/sbin/rpc.rexecd
  title=rpc.rexecd
  format=[text]1:text2:text3:text4
    comment=error message (failure only):
    comment="Remote execution requested by&colon;" hostname:
    comment="Username&colon;" username:
    comment="Command line&colon;" command attempted

label=AUE_rlogin
  title=rlogin
  program=/usr/sbin/login
  see=login(1) - rlogin
  format=[text]1
    comment=success/fail message

label=AUE_role_login
  program=SMC server
  title=SMC: role login
  format=[text]1
  comment=error message

label=AUE_rshd
  program=/usr/sbin/in.rshd
  title=in.rshd
  format=text1:text2:text3:[text]4
    comment="cmd" command:
    comment="remote user" remote user:
    comment="local user" local user:
    comment=failure message

label=AUE_scheduledjob_add
  program=SMC server
  see=
  title=SMC: scheduled job add
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=initial values

label=AUE_scheduledjob_modify
  see=
  program=SMC server
  title=SMC: scheduled job modify
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=changed values

label=AUE_scheduledjob_delete
  program=SMC server
  see=
  title=SMC: scheduled job delete
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=deleted values

label=AUE_screenlock
  program=desktop screen lock
  format=user

label=AUE_screenunlock
  program=desktop screen unlock
  format=user

label=AUE_serialport_add
  program=SMC server
  see=
  title=SMC: serial port add
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=initial values

label=AUE_serialport_modify
  program=SMC server
  see=
  title=SMC: serial port modify
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=changed values

label=AUE_serialport_delete
  program=SMC server
  see=
  title=SMC: serial port add
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=deleted values

label=AUE_shutdown_solaris
  title=shutdown
  program=/usr/ucb/shutdown
  format=user

label=AUE_smserverd
  program=/usr/lib/smedia/rpc.smserverd
  format=[text]1,[text]2
    comment=state change:
    comment=vid, pid, major/minor device

label=AUE_ssh
  program=/usr/lib/ssh/sshd
  format=[text]1
    comment=error message

label=AUE_su
  program=/usr/bin/su
  title=su
  see=su(1M)
  format=[text]1
    comment="success for user" name, or error message

label=AUE_telnet
  title=telnet login
  program=/usr/sbin/login
  see=login(1) - telnet
  format=[text]1
  comment=success/fail message

label=AUE_uadmin_solaris
  title=uadmin
  program=/sbin/uadmin;/usr/sbin/uadmin
  format=text1:text2
  comment=function code:argument code

label=AUE_uauth
  program=SMC server
  see=
  title=SMC:  Use of Authorization
  format=uauth1:text2
  comment=authorization used:
  comment=object name

label=AUE_usermgr_add
  see=
  program=SMC server
  title=SMC: User Manager add
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=initial values

label=AUE_usermgr_modify
  program=SMC server
  see=
  title=SMC: User Manager modify
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=changed values

label=AUE_usermgr_delete
  program=SMC server
  see=
  title=SMC: User Manager delete
  format=text1:[text]2:text3:uauth4:text5
  comment=object name:
  comment=domain:
  comment=name_service:
  comment=authorization used:
  comment=deleted values

label=AUE_zone_state
  format=text1:zone2
  comment=New zone state:zone name

label=AUE_file_relabel
  title=relabel file from one zone to another
  program=setlabel(1)
  see=setflabel(3TSOL)
  format=uauth1:text2:label3:label4
  comment=authorization used:
  comment=file relabeled:
  comment=original label:
  comment=new label

label=AUE_file_copy
  title=copy file to another zone
  program=dtfile(1X)
  see=
  format=uauth1:text2:label3:text4:label5
  comment=authorization used:
  comment=source file:
  comment=source label:
  comment=destination directory:
  comment=destination label

label=AUE_LABELSYS_TNRH
  title=config Trusted Network remote host cache
  see=tnrh(2)
  syscall=labelsys: TSOL_TNRH
  case=With the flush command (cmd=3)
    format=arg1
      comment=1, command, "cmd"
  case=With the load (cmd=1) and delete (cmd=2) commands
    format=arg1:inaddr2:arg3
      comment=1, command, "cmd":
      comment=ip address of host:
      comment=2, prefix length, "prefix len"

label=AUE_LABELSYS_TNRHTP
  title=config Trusted Network remote host template
  see=tnrhtp(2)
  syscall=labelsys: TSOL_TNRHTP
  case=With the flush command (cmd=3)
    format=arg1
      comment=1, command, "cmd"
  case=With the load (cmd=1) and delete (cmd=2) commands
    format=arg1:text2
      comment=1, command, "cmd":
      comment=name of template

label=AUE_LABELSYS_TNMLP
  title=config Trusted Network multi-level port entry
  see=tnmlp(2)
  syscall=labelsys: TSOL_TNMLP
  case=With the flush command (cmd=3)
    format=arg1:text2
      comment=1, command, "cmd":
      comment="shared", or name of zone
  case=With the load (cmd=1) and delete (cmd=2) commands
    format=arg1:text2:arg3:arg4:[arg]5
      comment=1, command, "cmd":
      comment="shared", or name of zone:
      comment=2, protocol number, "proto num":
      comment=2, starting mlp port number, "mlp_port":
      comment=2, ending mlp port number, "mlp_port_upper"

