Audit Logoff

struct ae_sesslogoff {
  unsigned short ae_sf_compname; /* offset */
  unsigned short ae_sf_username; /* offset */
  unsigned short ae_sf_reason;
};

where:

• ae_sf_compname is an offset (from the beginning address of the ae_sesslogoff data structure) to an ASCIIZ string indicating the requester that established the session.

• ae_sf_username is an offset (from the beginning address of the ae_sesslogoff data structure) to an ASCIIZ string indicating the name of the user who initiated the session. If 0, ae_sf_username and ae_sf_compname are the same.

• ae_sf_reason is one of five values indicating why the session was disconnected. These values, defined in the AUDIT.H header file, mean the following: ┌────────────────────┬───────┬─────────────────────────────────────────────────┐
  │ SYMBOLIC CONSTANT │ VALUE │ MEANING │
  ├────────────────────┼───────┼─────────────────────────────────────────────────┤
  │ AE_NORMAL │ 0 │ Normal disconnection or user name limit. │
  ├────────────────────┼───────┼─────────────────────────────────────────────────┤
  │ AE_ERROR │ 1 │ Error, session disconnect, or bad password. │
  ├────────────────────┼───────┼─────────────────────────────────────────────────┤
  │ AE_AUTODIS │ 2 │ Autodisconnect (timeout), share removed, or │
  │ │ │ administrative permissions required. │
  ├────────────────────┼───────┼─────────────────────────────────────────────────┤
  │ AE_ADMINDIS │ 3 │ Administrative disconnection (forced). │
  ├────────────────────┼───────┼─────────────────────────────────────────────────┤
  │ AE_ACCRESTRICT │ 4 │ Forced off by account system because of account │
  │ │ │ restriction, such as logon hours. │
  └────────────────────┴───────┴─────────────────────────────────────────────────┘