site_archiver@lists.apple.com Delivered-To: Darwin-kernel@lists.apple.com header,103,1,ioctl(2),0,Wed May 30 09:39:31 2007, + 11 msec argument,2,0x8004667e,cmd argument,1,0xbfffef40,arg argument,1,0x8,fd subject,heberlei,heberlei,staff,heberlei,staff,270,76,50331650,0.0.0.0 return,success,0 trailer,103 Is this a bug, or have I misinterpreted the specifications again? Thanks, Todd I don't know if the Darwin-kernel is the right location for question/ observations about the BSM auditing in Mac OS X (10.4.9 for PowerPC), but I couldn't find a more appropriate list. There might be a bug in the generation of ioctl() audit records in some instances. The argument descriptors are out of order (from what is specified in the Sun document for AUE_IOCTL), and two different arguments are listed as "argument 1": PS. If there is a more appropriate location to post questions/ observations about BSM auditing, please let me know. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... This email sent to site_archiver@lists.apple.com