Audit File Closed

struct ae_closefile {
  unsigned short ae_cf_compname; /* offset */
  unsigned short ae_cf_username; /* offset */
  unsigned short ae_cf_resname;  /* offset */
  unsigned short ae_cf_fileid;
  unsigned long  ae_cf_duration;
  unsigned short ae_cf_reason;
};

where:

• ae_cf_compname is an offset (from the beginning address of the ae_closefile data structure) to an ASCIIZ string indicating the name of the workstation that established the session.

• ae_cf_username is an offset (from the beginning address of the ae_closefile data structure) to an ASCIIZ string indicating the name of the user who initiated the session. If this field is 0, the user name and workstation name are assumed to be the same.

• ae_cf_resname is an offset (from the beginning address of the ae_closefile data structure) to an ASCIIZ string indicating the name of the resource that owns the accessed files.

• ae_cf_fileid is the identification number of the file.

• ae_cf_duration specifies how many seconds the resource was used.

• ae_cf_reason gives the reason the session was disconnected. These values, defined in the AUDIT.H header file, mean the following: ┌─────────────────────────┬────────────┬───────────────────────────────────────┐
  │ SYMBOLIC CONSTANT │ VALUE │ MEANING │
  ├─────────────────────────┼────────────┼───────────────────────────────────────┤
  │ AE_NORMALCLOSE │ 0 │ Normal client disconnection │
  ├─────────────────────────┼────────────┼───────────────────────────────────────┤
  │ AE_SES_CLOSE │ 1 │ Session disconnection │
  ├─────────────────────────┼────────────┼───────────────────────────────────────┤
  │ AE_ADMIN_CLOSE │ 2 │ Administrative disconnection │
  └─────────────────────────┴────────────┴───────────────────────────────────────┘