Hello,<br><br>I am currently doing a project based on the linux audit framework and i am using it to audit selected system calls. I have written my own parser for it. What i need to know is how many events are generated per system call so i know when it has finished. I have run a few test cases regarding this but i am not sure if i have covered every possible situation. Are the number of events generated per system call always the same or can they change from place to place. I&#39;ll illustrate what i am saying.<br>
<br>For example when an OPEN system call happens three events are generated by the audit frame work i.e. SYSCALL,CWD,PATH events. These three together define the open system call. I am trying to get the same profile for the following calls:<br>
(i am adding the profiles i have already tested for)<br><br><br>open = sys.cwd.path<br>execv = sys.execve.cwd.path.path<br>clone<br>vfork  = clone+execve<br>fork  = clone+execve<br>connect<br>accept<br><br>close <br><br><br>
read = sys<br>readv<br>write  = sys<br>writev<br><br><br><br>rename  = sys.cwd.path.path.path.path.path<br><br>mknod = sws.cwd.path<br>truncate = open+read+write<br>ftruncate = open+read+write<br><br>link<br><br>unlink <br>
<br>symlink<br><br>pipe = sys.fd_pair<br>dup<br>dup2<br><br>It would be really helpful to know if the number of events generated per system call change or do they stay the same. And is there any documentation on what events are generated or do i have to run small test cases for all the aforementioned system calls.<br>
<br>Thanks,<br>Basim<br><br>