Trigger AUE_OPEN, AUE_WRITEV, AUE_TRUNCATE, and AUE_FTRUNCATE events

Question

I'm trying to trigger AUE_OPEN, AUE_WRITEV, AUE_TRUNCATE and AUE_FTRUNCATE events on Solaris 10 global zone but without success. Basically, I wrote a C program with the following function calls:
void WRITEV(char *file)
struct iovec iov[2];
char *str0="hello ";
char *str1="world\n";
int fd;
fd = open_file(file);
/* write file using writev */
iov[0].iov_base = str0;
iov[0].iov_len = strlen(str0);
iov[1].iov_base = str1;
iov[1].iov_len = strlen(str1);
writev(fd, iov, 2);
close(fd);
void TRUNCATE(char *file)
int fd;
fd = init_file(file);
truncate(file,5);
void FTRUNCATE(char *file)
int fd;
fd = init_file(file);
ftruncate(fd,2);
I saw content written the to file and the file got truncated to correct length, but I don't see any audit events generated.
Yes, I did enabled BSM auditing and audit_event file has the right mode(s) specified.
As to AUE_OPEN, any one has an example that I can use? I can't think of a case that AUE_OPEN is not tied to READ, WRITE, RW, CREAT, or TRUNC.
Thanks for your help!!

Answer 1

We are having the same issue as well. We have been working on it. If I have a solution I will post. Good luck!