| isfd | isam file identifier |
| pad | pointer to pad, usage dependent on mode |
| mode | operation mode, see below |
SUCCESS, or a negative value on error, in which case the error code is found in iserrno.
Mode is one of the following:
AUDSTART start recording AUDSTOP stop recording AUDSETNAME name and path of audit file AUDGETNAME return current name and path AUDINFO recording status
start and stop do not refer to pad, AUDSETNAME and AUDGETNAME will store and retrieve (respectively) a null terminated string from or to pad. AUDINFO will set the first byte of pad to a value of zero (stopped) or one (active).
there are a couple of obvious caveats:
do not start recording until you have set a file name. be careful not to use the same audit file for more than one file.
the filename cannot be longer than 64 characters.