FreeBSD/contrib/openbsm/bin/auditd/auditd.c
/*
 * Create the new file name, swap with existing audit file.
 */
Create the new file name, swap with existing audit file.
Create the new file name swap with existing audit file .
static int
swap_audit_file(void)
{
	int err;
	char *newfile, *name;
	char TS[TIMESTAMP_LEN + 1];
	time_t tt;
	if (getTSstr(tt, TS, sizeof(TS)) != 0)
		return (-1);
	if (lastfile == NULL) {
		name = NULL;
	} else {
		name = strrchr(lastfile, '/');
		if (name != NULL)
			name++;
	}
	if (name != NULL && strncmp(name, TS, TIMESTAMP_LEN) == 0) {
		auditd_log_debug("Not ready to terminate trail file yet.");
		return (0);
	}
	err = auditd_swap_trail(TS, &newfile, audit_review_gid,
	    audit_warn_getacdir);
	if (err != ADE_NOERR) {
		auditd_log_err("%s: %m", auditd_strerror(err));
		if (err != ADE_ACTL)
			return (-1);
	}
	if (auditd_get_state() == AUD_STATE_ENABLED)
		close_lastfile(TS);
	auditd_set_state(AUD_STATE_ENABLED);
	if (auditd_new_curlink(newfile) != 0)
		auditd_log_err("auditd_new_curlink(\"%s\") failed: %s: %m",
		    newfile, auditd_strerror(err));
	lastfile = newfile;
	auditd_log_notice("New audit file is %s", newfile);
	return (0);
}
static int swap_audit_file ( void ) { int err ; char * newfile , * name ; char TS [ TIMESTAMP_LEN + 1 ] ; time_t tt ; if ( getTSstr ( tt , TS , sizeof ( TS ) ) != 0 ) return ( -1 ) ; if ( lastfile == NULL ) { name = NULL ; } else { name = strrchr ( lastfile , ' ' ) ; if ( name != NULL ) name ++ ; } if ( name != NULL && strncmp ( name , TS , TIMESTAMP_LEN ) == 0 ) { auditd_log_debug ( " " ) ; return ( 0 ) ; } err = auditd_swap_trail ( TS , & newfile , audit_review_gid , audit_warn_getacdir ) ; if ( err != ADE_NOERR ) { auditd_log_err ( " " , auditd_strerror ( err ) ) ; if ( err != ADE_ACTL ) return ( -1 ) ; } if ( auditd_get_state ( ) == AUD_STATE_ENABLED ) close_lastfile ( TS ) ; auditd_set_state ( AUD_STATE_ENABLED ) ; if ( auditd_new_curlink ( newfile ) != 0 ) auditd_log_err ( " \" \" " , newfile , auditd_strerror ( err ) ) ; lastfile = newfile ; auditd_log_notice ( " " , newfile ) ; return ( 0 ) ; }
Create the new file name, swap with existing audit file.
Create the new file name swap with existing audit file .
/*
	 * If prefix and suffix are the same, it means that records are
	 * being produced too fast. We don't want to rename now, because
	 * next trail file can get the same name and once that one is
	 * terminated also within one second it will overwrite the current
	 * one. Just keep writing to the same trail and wait for the next
	 * trigger from the kernel.
	 * FREEBSD KERNEL WAS UPDATED TO KEEP SENDING TRIGGERS, WHICH MIGHT
	 * NOT BE THE CASE FOR OTHER OSES.
	 * If the kernel will not keep sending triggers, trail file will not
	 * be terminated.
	 */ /*
	 * Only close the last file if were in an auditing state before
	 * calling swap_audit_file().  We may need to recover from a crash.
	 */ /*
	 * auditd_swap_trail() potentially enables auditing (if not already
	 * enabled) so updated the cached state as well.
	 */ /*
	 *  Create 'current' symlink.  Recover from crash, if needed.
	 */