Debora Velarde/Austin/IBM wrote on 07/19/2005 11:16:47 AM:

> Hi All,
>
> We were asked to modify our 'at' and 'crontab' testcases so that the
> job being run contained a syscall.  Then we needed to verify that
> the correct audit record was generated for that syscall.  In doing
> so, I see that the audit record for the syscall executed by the job,
> contains "auid=0", rather than "auid=500" which is the user I
> initially logged in with.
>
> I asked Klaus if this behavior is valid.  His reply, "The syscall
> audit record needs to have the auid of the user on whose
> behalf the job is executing, for example auid=500, *not* 0."
>
> -debbie


My apologies, this was a testcase problem.  auid is fine.

-debbie