record_t

kind = SYSCALL

data = {

time

serial

arch

syscall_num

success

exit

a0

a1

a2

a3

items

pid

auid

uid

.

.

.

fsgid

comm

exe

}

next

kind = FS_WATCH

data = {

time

serial

watch_inode

watch

filterkey

perm

perm_mask

}

next

kind = FS_INODE

data = {

time

serial

inode

inode_uid

inode_gid

inode_dev

inode_rdev

}

next = NULL

record_t

record_t

next_record

next_record = NULL

records_t

2005-09-29T16:38:32