Debora Velarde/Austin/IBM wrote on 07/19/2005 11:16:47 AM:
Hi All,
We were asked to modify our 'at' and 'crontab' testcases so that the
job being run contained a syscall. Then we needed to verify that
the correct audit record was generated for that syscall. In doing
so, I see that the audit record for the syscall executed by the job,
contains "auid=0", rather than "auid=500" which is the user I
initially logged in with.
I asked Klaus if this behavior is valid. His reply, "The syscall
audit record needs to have the auid of the user on whose
behalf the job is executing, for example auid=500, *not* 0."
-debbie
My apologies, this was a testcase problem. auid is fine.
-debbie