auparse

package
v0.4.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 30, 2018 License: Apache-2.0 Imports: 10 Imported by: 0

Documentation

Overview

Package auparse is a pure Go audit log parsing library. It can parse and enrich audit messages from the Linux kernel.

Each message is composed of multiple fields that are reported as key=value. Any data that does not have an equal sign is superfluous and is ignored.

Index

Examples

Constants

This section is empty.

Variables

View Source
var AuditArchNames = map[AuditArch]string{
	AUDIT_ARCH_AARCH64:     "aarch64",
	AUDIT_ARCH_ARM:         "arm",
	AUDIT_ARCH_ARMEB:       "armeb",
	AUDIT_ARCH_CRIS:        "cris",
	AUDIT_ARCH_FRV:         "frv",
	AUDIT_ARCH_I386:        "i386",
	AUDIT_ARCH_IA64:        "ia64",
	AUDIT_ARCH_M32R:        "m32r",
	AUDIT_ARCH_M68K:        "m68k",
	AUDIT_ARCH_MIPS:        "mips",
	AUDIT_ARCH_MIPS64:      "mips64",
	AUDIT_ARCH_MIPS64N32:   "mips64n32",
	AUDIT_ARCH_MIPSEL:      "mipsel",
	AUDIT_ARCH_MIPSEL64:    "mipsel64",
	AUDIT_ARCH_MIPSEL64N32: "mipsel64n32",
	AUDIT_ARCH_PARISC:      "parisc",
	AUDIT_ARCH_PARISC64:    "parisc64",
	AUDIT_ARCH_PPC:         "ppc",
	AUDIT_ARCH_PPC64:       "ppc64",
	AUDIT_ARCH_PPC64LE:     "ppc64le",
	AUDIT_ARCH_S390:        "s390",
	AUDIT_ARCH_S390X:       "s390x",
	AUDIT_ARCH_SH:          "sh",
	AUDIT_ARCH_SH64:        "sh64",
	AUDIT_ARCH_SHEL:        "shel",
	AUDIT_ARCH_SHEL64:      "shel64",
	AUDIT_ARCH_SPARC:       "sparc",
	AUDIT_ARCH_SPARC64:     "sparc64",
	AUDIT_ARCH_X86_64:      "x86_64",
}
View Source
var AuditErrnoToName = map[int]string{}/* 131 elements not displayed */
View Source
var AuditErrnoToNum = map[string]int{}/* 133 elements not displayed */
View Source
var AuditSyscalls = map[string]map[int]string{
	"aarch64": {
		0:   "io_setup",
		1:   "io_destroy",
		2:   "io_submit",
		3:   "io_cancel",
		4:   "io_getevents",
		5:   "setxattr",
		6:   "lsetxattr",
		7:   "fsetxattr",
		8:   "getxattr",
		9:   "lgetxattr",
		10:  "fgetxattr",
		11:  "listxattr",
		12:  "llistxattr",
		13:  "flistxattr",
		14:  "removexattr",
		15:  "lremovexattr",
		16:  "fremovexattr",
		17:  "getcwd",
		18:  "lookup_dcookie",
		19:  "eventfd2",
		20:  "epoll_create1",
		21:  "epoll_ctl",
		22:  "epoll_pwait",
		23:  "dup",
		24:  "dup3",
		25:  "fcntl",
		26:  "inotify_init1",
		27:  "inotify_add_watch",
		28:  "inotify_rm_watch",
		29:  "ioctl",
		30:  "ioprio_set",
		31:  "ioprio_get",
		32:  "flock",
		33:  "mknodat",
		34:  "mkdirat",
		35:  "unlinkat",
		36:  "symlinkat",
		37:  "linkat",
		38:  "renameat",
		39:  "umount2",
		40:  "mount",
		41:  "pivot_root",
		42:  "nfsservctl",
		43:  "statfs",
		44:  "fstatfs",
		45:  "truncate",
		46:  "ftruncate",
		47:  "fallocate",
		48:  "faccessat",
		49:  "chdir",
		50:  "fchdir",
		51:  "chroot",
		52:  "fchmod",
		53:  "fchmodat",
		54:  "fchownat",
		55:  "fchown",
		56:  "openat",
		57:  "close",
		58:  "vhangup",
		59:  "pipe2",
		60:  "quotactl",
		61:  "getdents",
		62:  "lseek",
		63:  "read",
		64:  "write",
		65:  "readv",
		66:  "writev",
		67:  "pread",
		68:  "pwrite",
		69:  "preadv",
		70:  "pwritev",
		71:  "sendfile",
		72:  "pselect6",
		73:  "ppoll",
		74:  "signalfd4",
		75:  "vmsplice",
		76:  "splice",
		77:  "tee",
		78:  "readlinkat",
		79:  "newfstatat",
		80:  "newfstat",
		81:  "sync",
		82:  "fsync",
		83:  "fdatasync",
		84:  "sync_file_range",
		85:  "timerfd_create",
		86:  "timerfd_settime",
		87:  "timerfd_gettime",
		88:  "utimensat",
		89:  "acct",
		90:  "capget",
		91:  "capset",
		92:  "personality",
		93:  "exit",
		94:  "exit_group",
		95:  "waitid",
		96:  "set_tid_address",
		97:  "unshare",
		98:  "futex",
		99:  "set_robust_list",
		100: "get_robust_list",
		101: "nanosleep",
		102: "getitimer",
		103: "setitimer",
		104: "kexec_load",
		105: "init_module",
		106: "delete_module",
		107: "timer_create",
		108: "timer_gettime",
		109: "timer_getoverrun",
		110: "timer_settime",
		111: "timer_delete",
		112: "clock_settime",
		113: "clock_gettime",
		114: "clock_getres",
		115: "clock_nanosleep",
		116: "syslog",
		117: "ptrace",
		118: "sched_setparam",
		119: "sched_setscheduler",
		120: "sched_getscheduler",
		121: "sched_getparam",
		122: "sched_setaffinity",
		123: "sched_getaffinity",
		124: "sched_yield",
		125: "sched_get_priority_max",
		126: "sched_get_priority_min",
		127: "sched_rr_get_interval",
		128: "restart_syscall",
		129: "kill",
		130: "tkill",
		131: "tgkill",
		132: "sigaltstack",
		133: "rt_sigsuspend",
		134: "rt_sigaction",
		135: "rt_sigprocmask",
		136: "rt_sigpending",
		137: "rt_sigtimedwait",
		138: "rt_sigqueueinfo",
		139: "rt_sigreturn",
		140: "setpriority",
		141: "getpriority",
		142: "reboot",
		143: "setregid",
		144: "setgid",
		145: "setreuid",
		146: "setuid",
		147: "setresuid",
		148: "getresuid",
		149: "setresgid",
		150: "getresgid",
		151: "setfsuid",
		152: "setfsgid",
		153: "times",
		154: "setpgid",
		155: "getpgid",
		156: "getsid",
		157: "setsid",
		158: "getgroups",
		159: "setgroups",
		160: "uname",
		161: "sethostname",
		162: "setdomainname",
		163: "getrlimit",
		164: "setrlimit",
		165: "getrusage",
		166: "umask",
		167: "prctl",
		168: "getcpu",
		169: "gettimeofday",
		170: "settimeofday",
		171: "adjtimex",
		172: "getpid",
		173: "getppid",
		174: "getuid",
		175: "geteuid",
		176: "getgid",
		177: "getegid",
		178: "gettid",
		179: "sysinfo",
		180: "mq_open",
		181: "mq_unlink",
		182: "mq_timedsend",
		183: "mq_timedreceive",
		184: "mq_notify",
		185: "mq_getsetattr",
		186: "msgget",
		187: "msgctl",
		188: "msgrcv",
		189: "msgsnd",
		190: "semget",
		191: "semctl",
		192: "semtimedop",
		193: "semop",
		194: "shmget",
		195: "shmctl",
		196: "shmat",
		197: "shmdt",
		198: "socket",
		199: "socketpair",
		200: "bind",
		201: "listen",
		202: "accept",
		203: "connect",
		204: "getsockname",
		205: "getpeername",
		206: "sendto",
		207: "recvfrom",
		208: "setsockopt",
		209: "getsockopt",
		210: "shutdown",
		211: "sendmsg",
		212: "recvmsg",
		213: "readahead",
		214: "brk",
		215: "munmap",
		216: "mremap",
		217: "add_key",
		218: "request_key",
		219: "keyctl",
		220: "clone",
		221: "execve",
		222: "mmap",
		223: "fadvise64",
		224: "swapon",
		225: "swapoff",
		226: "mprotect",
		227: "msync",
		228: "mlock",
		229: "munlock",
		230: "mlockall",
		231: "munlockall",
		232: "mincore",
		233: "madvise",
		234: "remap_file_pages",
		235: "mbind",
		236: "get_mempolicy",
		237: "set_mempolicy",
		238: "migrate_pages",
		239: "move_pages",
		240: "rt_tgsigqueueinfo",
		241: "perf_event_open",
		242: "accept4",
		243: "recvmmsg",
		260: "wait4",
		261: "prlimit64",
		262: "fanotify_init",
		263: "fanotify_mark",
		264: "name_to_handle_at",
		265: "open_by_handle_at",
		266: "clock_adjtime",
		267: "syncfs",
		268: "setns",
		269: "sendmmsg",
		270: "process_vm_readv",
		271: "process_vm_writev",
		272: "kcmp",
		273: "finit_module",
		274: "sched_setattr",
		275: "sched_getattr",
		276: "renameat2",
		277: "seccomp",
		278: "getrandom",
		279: "memfd_create",
		280: "bpf",
		281: "execveat",
		282: "userfaultfd",
		283: "membarrier",
		284: "mlock2",
		285: "copy_file_range",
		286: "preadv2",
		287: "pwritev2",
		288: "pkey_mprotect",
		289: "pkey_alloc",
		290: "pkey_free",
	},
	"arm": {
		0:   "restart_syscall",
		1:   "exit",
		2:   "fork",
		3:   "read",
		4:   "write",
		5:   "open",
		6:   "close",
		8:   "creat",
		9:   "link",
		10:  "unlink",
		11:  "execve",
		12:  "chdir",
		13:  "time",
		14:  "mknod",
		15:  "chmod",
		16:  "lchown",
		19:  "lseek",
		20:  "getpid",
		21:  "mount",
		22:  "umount",
		23:  "setuid",
		24:  "getuid",
		25:  "stime",
		26:  "ptrace",
		27:  "alarm",
		29:  "pause",
		30:  "utime",
		33:  "access",
		34:  "nice",
		36:  "sync",
		37:  "kill",
		38:  "rename",
		39:  "mkdir",
		40:  "rmdir",
		41:  "dup",
		42:  "pipe",
		43:  "times",
		45:  "brk",
		46:  "setgid",
		47:  "getgid",
		49:  "geteuid",
		50:  "getegid",
		51:  "acct",
		52:  "umount2",
		54:  "ioctl",
		55:  "fcntl",
		57:  "setpgid",
		60:  "umask",
		61:  "chroot",
		62:  "ustat",
		63:  "dup2",
		64:  "getppid",
		65:  "getpgrp",
		66:  "setsid",
		67:  "sigaction",
		70:  "setreuid",
		71:  "setregid",
		72:  "sigsuspend",
		73:  "sigpending",
		74:  "sethostname",
		75:  "setrlimit",
		76:  "getrlimit",
		77:  "getrusage",
		78:  "gettimeofday",
		79:  "settimeofday",
		80:  "getgroups",
		81:  "setgroups",
		82:  "select",
		83:  "symlink",
		85:  "readlink",
		86:  "uselib",
		87:  "swapon",
		88:  "reboot",
		89:  "readdir",
		90:  "mmap",
		91:  "munmap",
		92:  "truncate",
		93:  "ftruncate",
		94:  "fchmod",
		95:  "fchown",
		96:  "getpriority",
		97:  "setpriority",
		99:  "statfs",
		100: "fstatfs",
		102: "socketcall",
		103: "syslog",
		104: "setitimer",
		105: "getitimer",
		106: "stat",
		107: "lstat",
		108: "fstat",
		111: "vhangup",
		113: "syscall",
		114: "wait4",
		115: "swapoff",
		116: "sysinfo",
		117: "ipc",
		118: "fsync",
		119: "sigreturn",
		120: "clone",
		121: "setdomainname",
		122: "uname",
		124: "adjtimex",
		125: "mprotect",
		126: "sigprocmask",
		128: "init_module",
		129: "delete_module",
		131: "quotactl",
		132: "getpgid",
		133: "fchdir",
		134: "bdflush",
		135: "sysfs",
		136: "personality",
		138: "setfsuid",
		139: "setfsgid",
		140: "llseek",
		141: "getdents",
		142: "newselect",
		143: "flock",
		144: "msync",
		145: "readv",
		146: "writev",
		147: "getsid",
		148: "fdatasync",
		149: "sysctl",
		150: "mlock",
		151: "munlock",
		152: "mlockall",
		153: "munlockall",
		154: "sched_setparam",
		155: "sched_getparam",
		156: "sched_setscheduler",
		157: "sched_getscheduler",
		158: "sched_yield",
		159: "sched_get_priority_max",
		160: "sched_get_priority_min",
		161: "sched_rr_get_interval",
		162: "nanosleep",
		163: "mremap",
		164: "setresuid",
		165: "getresuid",
		168: "poll",
		169: "nfsservctl",
		170: "setresgid",
		171: "getresgid",
		172: "prctl",
		173: "rt_sigreturn",
		174: "rt_sigaction",
		175: "rt_sigprocmask",
		176: "rt_sigpending",
		177: "rt_sigtimedwait",
		178: "rt_sigqueueinfo",
		179: "rt_sigsuspend",
		180: "pread64",
		181: "pwrite64",
		182: "chown",
		183: "getcwd",
		184: "capget",
		185: "capset",
		186: "sigaltstack",
		187: "sendfile",
		190: "vfork",
		191: "ugetrlimit",
		192: "mmap2",
		193: "truncate64",
		194: "ftruncate64",
		195: "stat64",
		196: "lstat64",
		197: "fstat64",
		198: "lchown32",
		199: "getuid32",
		200: "getgid32",
		201: "geteuid32",
		202: "getegid32",
		203: "setreuid32",
		204: "setregid32",
		205: "getgroups32",
		206: "setgroups32",
		207: "fchown32",
		208: "setresuid32",
		209: "getresuid32",
		210: "setresgid32",
		211: "getresgid32",
		212: "chown32",
		213: "setuid32",
		214: "setgid32",
		215: "setfsuid32",
		216: "setfsgid32",
		217: "getdents64",
		218: "pivot_root",
		219: "mincore",
		220: "madvise",
		221: "fcntl64",
		224: "gettid",
		225: "readahead",
		226: "setxattr",
		227: "lsetxattr",
		228: "fsetxattr",
		229: "getxattr",
		230: "lgetxattr",
		231: "fgetxattr",
		232: "listxattr",
		233: "llistxattr",
		234: "flistxattr",
		235: "removexattr",
		236: "lremovexattr",
		237: "fremovexattr",
		238: "tkill",
		239: "sendfile64",
		240: "futex",
		241: "sched_setaffinity",
		242: "sched_getaffinity",
		243: "io_setup",
		244: "io_destroy",
		245: "io_getevents",
		246: "io_submit",
		247: "io_cancel",
		248: "exit_group",
		249: "lookup_dcookie",
		250: "epoll_create",
		251: "epoll_ctl",
		252: "epoll_wait",
		253: "remap_file_pages",
		256: "set_tid_address",
		257: "timer_create",
		258: "timer_settime",
		259: "timer_gettime",
		260: "timer_getoverrun",
		261: "timer_delete",
		262: "clock_settime",
		263: "clock_gettime",
		264: "clock_getres",
		265: "clock_nanosleep",
		266: "statfs64",
		267: "fstatfs64",
		268: "tgkill",
		269: "utimes",
		270: "fadvise64_64",
		271: "pciconfig_iobase",
		272: "pciconfig_read",
		273: "pciconfig_write",
		274: "mq_open",
		275: "mq_unlink",
		276: "mq_timedsend",
		277: "mq_timedreceive",
		278: "mq_notify",
		279: "mq_getsetattr",
		280: "waitid",
		281: "socket",
		282: "bind",
		283: "connect",
		284: "listen",
		285: "accept",
		286: "getsockname",
		287: "getpeername",
		288: "socketpair",
		289: "send",
		290: "sendto",
		291: "recv",
		292: "recvfrom",
		293: "shutdown",
		294: "setsockopt",
		295: "getsockopt",
		296: "sendmsg",
		297: "recvmsg",
		298: "semop",
		299: "semget",
		300: "semctl",
		301: "msgsnd",
		302: "msgrcv",
		303: "msgget",
		304: "msgctl",
		305: "shmat",
		306: "shmdt",
		307: "shmget",
		308: "shmctl",
		309: "add_key",
		310: "request_key",
		311: "keyctl",
		312: "semtimedop",
		313: "vserver",
		314: "ioprio_set",
		315: "ioprio_get",
		316: "inotify_init",
		317: "inotify_add_watch",
		318: "inotify_rm_watch",
		319: "mbind",
		320: "get_mempolicy",
		321: "set_mempolicy",
		322: "openat",
		323: "mkdirat",
		324: "mknodat",
		325: "fchownat",
		326: "futimesat",
		327: "fstatat64",
		328: "unlinkat",
		329: "renameat",
		330: "linkat",
		331: "symlinkat",
		332: "readlinkat",
		333: "fchmodat",
		334: "faccessat",
		337: "unshare",
		338: "set_robust_list",
		339: "get_robust_list",
		340: "splice",
		341: "sync_file_range",
		342: "tee",
		343: "vmsplice",
		344: "move_pages",
		345: "getcpu",
		347: "kexec_load",
		348: "utimensat",
		349: "signalfd",
		350: "timerfd_create",
		351: "eventfd",
		352: "fallocate",
		353: "timerfd_settime",
		354: "timerfd_gettime",
		355: "signalfd4",
		356: "eventfd2",
		357: "epoll_create1",
		358: "dup3",
		359: "pipe2",
		360: "inotify_init1",
		361: "preadv",
		362: "pwritev",
		363: "rt_tgsigqueueinfo",
		364: "perf_event_open",
		365: "recvmmsg",
		366: "accept4",
		367: "fanotify_init",
		368: "fanotify_mark",
		369: "prlimit64",
		370: "name_to_handle_at",
		371: "open_by_handle_at",
		372: "clock_adjtime",
		373: "syncfs",
		374: "sendmmsg",
		375: "setns",
		376: "process_vm_readv",
		377: "process_vm_writev",
		378: "kcmp",
		379: "finit_module",
		380: "sched_setattr",
		381: "sched_getattr",
		382: "renameat2",
		383: "seccomp",
		384: "getrandom",
		385: "memfd_create",
		386: "bpf",
		387: "execveat",
		388: "userfaultfd",
		389: "membarrier",
		390: "mlock2",
		391: "copy_file_range",
		392: "preadv2",
		393: "pwritev2",
		394: "pkey_mprotect",
		395: "pkey_alloc",
		396: "pkey_free",
		397: "statx",
	},
	"i386": {
		0:   "restart_syscall",
		1:   "exit",
		2:   "fork",
		3:   "read",
		4:   "write",
		5:   "open",
		6:   "close",
		7:   "waitpid",
		8:   "creat",
		9:   "link",
		10:  "unlink",
		11:  "execve",
		12:  "chdir",
		13:  "time",
		14:  "mknod",
		15:  "chmod",
		16:  "lchown",
		17:  "break",
		18:  "oldstat",
		19:  "lseek",
		20:  "getpid",
		21:  "mount",
		22:  "umount",
		23:  "setuid",
		24:  "getuid",
		25:  "stime",
		26:  "ptrace",
		27:  "alarm",
		28:  "oldfstat",
		29:  "pause",
		30:  "utime",
		31:  "stty",
		32:  "gtty",
		33:  "access",
		34:  "nice",
		35:  "ftime",
		36:  "sync",
		37:  "kill",
		38:  "rename",
		39:  "mkdir",
		40:  "rmdir",
		41:  "dup",
		42:  "pipe",
		43:  "times",
		44:  "prof",
		45:  "brk",
		46:  "setgid",
		47:  "getgid",
		48:  "signal",
		49:  "geteuid",
		50:  "getegid",
		51:  "acct",
		52:  "umount2",
		53:  "lock",
		54:  "ioctl",
		55:  "fcntl",
		56:  "mpx",
		57:  "setpgid",
		58:  "ulimit",
		59:  "oldolduname",
		60:  "umask",
		61:  "chroot",
		62:  "ustat",
		63:  "dup2",
		64:  "getppid",
		65:  "getpgrp",
		66:  "setsid",
		67:  "sigaction",
		68:  "sgetmask",
		69:  "ssetmask",
		70:  "setreuid",
		71:  "setregid",
		72:  "sigsuspend",
		73:  "sigpending",
		74:  "sethostname",
		75:  "setrlimit",
		76:  "getrlimit",
		77:  "getrusage",
		78:  "gettimeofday",
		79:  "settimeofday",
		80:  "getgroups",
		81:  "setgroups",
		82:  "select",
		83:  "symlink",
		84:  "oldlstat",
		85:  "readlink",
		86:  "uselib",
		87:  "swapon",
		88:  "reboot",
		89:  "readdir",
		90:  "mmap",
		91:  "munmap",
		92:  "truncate",
		93:  "ftruncate",
		94:  "fchmod",
		95:  "fchown",
		96:  "getpriority",
		97:  "setpriority",
		98:  "profil",
		99:  "statfs",
		100: "fstatfs",
		101: "ioperm",
		102: "socketcall",
		103: "syslog",
		104: "setitimer",
		105: "getitimer",
		106: "stat",
		107: "lstat",
		108: "fstat",
		109: "olduname",
		110: "iopl",
		111: "vhangup",
		112: "idle",
		113: "vm86old",
		114: "wait4",
		115: "swapoff",
		116: "sysinfo",
		117: "ipc",
		118: "fsync",
		119: "sigreturn",
		120: "clone",
		121: "setdomainname",
		122: "uname",
		123: "modify_ldt",
		124: "adjtimex",
		125: "mprotect",
		126: "sigprocmask",
		127: "create_module",
		128: "init_module",
		129: "delete_module",
		130: "get_kernel_syms",
		131: "quotactl",
		132: "getpgid",
		133: "fchdir",
		134: "bdflush",
		135: "sysfs",
		136: "personality",
		137: "afs_syscall",
		138: "setfsuid",
		139: "setfsgid",
		140: "_llseek",
		141: "getdents",
		142: "_newselect",
		143: "flock",
		144: "msync",
		145: "readv",
		146: "writev",
		147: "getsid",
		148: "fdatasync",
		149: "_sysctl",
		150: "mlock",
		151: "munlock",
		152: "mlockall",
		153: "munlockall",
		154: "sched_setparam",
		155: "sched_getparam",
		156: "sched_setscheduler",
		157: "sched_getscheduler",
		158: "sched_yield",
		159: "sched_get_priority_max",
		160: "sched_get_priority_min",
		161: "sched_rr_get_interval",
		162: "nanosleep",
		163: "mremap",
		164: "setresuid",
		165: "getresuid",
		166: "vm86",
		167: "query_module",
		168: "poll",
		169: "nfsservctl",
		170: "setresgid",
		171: "getresgid",
		172: "prctl",
		173: "rt_sigreturn",
		174: "rt_sigaction",
		175: "rt_sigprocmask",
		176: "rt_sigpending",
		177: "rt_sigtimedwait",
		178: "rt_sigqueueinfo",
		179: "rt_sigsuspend",
		180: "pread64",
		181: "pwrite64",
		182: "chown",
		183: "getcwd",
		184: "capget",
		185: "capset",
		186: "sigaltstack",
		187: "sendfile",
		188: "getpmsg",
		189: "putpmsg",
		190: "vfork",
		191: "ugetrlimit",
		192: "mmap2",
		193: "truncate64",
		194: "ftruncate64",
		195: "stat64",
		196: "lstat64",
		197: "fstat64",
		198: "lchown32",
		199: "getuid32",
		200: "getgid32",
		201: "geteuid32",
		202: "getegid32",
		203: "setreuid32",
		204: "setregid32",
		205: "getgroups32",
		206: "setgroups32",
		207: "fchown32",
		208: "setresuid32",
		209: "getresuid32",
		210: "setresgid32",
		211: "getresgid32",
		212: "chown32",
		213: "setuid32",
		214: "setgid32",
		215: "setfsuid32",
		216: "setfsgid32",
		217: "pivot_root",
		218: "mincore",
		219: "madvise1",
		220: "getdents64",
		221: "fcntl64",
		224: "gettid",
		225: "readahead",
		226: "setxattr",
		227: "lsetxattr",
		228: "fsetxattr",
		229: "getxattr",
		230: "lgetxattr",
		231: "fgetxattr",
		232: "listxattr",
		233: "llistxattr",
		234: "flistxattr",
		235: "removexattr",
		236: "lremovexattr",
		237: "fremovexattr",
		238: "tkill",
		239: "sendfile64",
		240: "futex",
		241: "sched_setaffinity",
		242: "sched_getaffinity",
		243: "set_thread_area",
		244: "get_thread_area",
		245: "io_setup",
		246: "io_destroy",
		247: "io_getevents",
		248: "io_submit",
		249: "io_cancel",
		250: "fadvise64",
		252: "exit_group",
		253: "lookup_dcookie",
		254: "epoll_create",
		255: "epoll_ctl",
		256: "epoll_wait",
		257: "remap_file_pages",
		258: "set_tid_address",
		259: "timer_create",
		260: "timer_settime",
		261: "timer_gettime",
		262: "timer_getoverrun",
		263: "timer_delete",
		264: "clock_settime",
		265: "clock_gettime",
		266: "clock_getres",
		267: "clock_nanosleep",
		268: "statfs64",
		269: "fstatfs64",
		270: "tgkill",
		271: "utimes",
		272: "fadvise64_64",
		273: "vserver",
		274: "mbind",
		275: "get_mempolicy",
		276: "set_mempolicy",
		277: "mq_open",
		278: "mq_unlink",
		279: "mq_timedsend",
		280: "mq_timedreceive",
		281: "mq_notify",
		282: "mq_getsetattr",
		283: "sys_kexec_load",
		284: "waitid",
		286: "add_key",
		287: "request_key",
		288: "keyctl",
		289: "ioprio_set",
		290: "ioprio_get",
		291: "inotify_init",
		292: "inotify_add_watch",
		293: "inotify_rm_watch",
		294: "migrate_pages",
		295: "openat",
		296: "mkdirat",
		297: "mknodat",
		298: "fchownat",
		299: "futimesat",
		300: "fstatat64",
		301: "unlinkat",
		302: "renameat",
		303: "linkat",
		304: "symlinkat",
		305: "readlinkat",
		306: "fchmodat",
		307: "faccessat",
		308: "pselect6",
		309: "ppoll",
		310: "unshare",
		311: "set_robust_list",
		312: "get_robust_list",
		313: "splice",
		314: "sync_file_range",
		315: "tee",
		316: "vmsplice",
		317: "move_pages",
		318: "getcpu",
		319: "epoll_pwait",
		320: "utimensat",
		321: "signalfd",
		322: "timerfd",
		323: "eventfd",
		324: "fallocate",
		325: "timerfd_settime",
		326: "timerfd_gettime",
		327: "signalfd4",
		328: "eventfd2",
		329: "epoll_create1",
		330: "dup3",
		331: "pipe2",
		332: "inotify_init1",
		333: "preadv",
		334: "pwritev",
		335: "rt_tgsigqueueinfo",
		336: "perf_event_open",
		337: "recvmmsg",
		338: "fanotify_init",
		339: "fanotify_mark",
		340: "prlimit64",
		341: "name_to_handle_at",
		342: "open_by_handle_at",
		343: "clock_adjtime",
		344: "syncfs",
		345: "sendmmsg",
		346: "setns",
		347: "process_vm_readv",
		348: "process_vm_writev",
		349: "kcmp",
		350: "finit_module",
		351: "sched_setattr",
		352: "sched_getattr",
		353: "renameat2",
		354: "seccomp",
		355: "getrandom",
		356: "memfd_create",
		357: "bpf",
		358: "execveat",
		359: "socket",
		360: "socketpair",
		361: "bind",
		362: "connect",
		363: "listen",
		364: "accept4",
		365: "getsockopt",
		366: "setsockopt",
		367: "getsockname",
		368: "getpeername",
		369: "sendto",
		370: "sendmsg",
		371: "recvfrom",
		372: "recvmsg",
		373: "shutdown",
		374: "userfaultfd",
		375: "membarrier",
		376: "mlock2",
		377: "copy_file_range",
		378: "preadv2",
		379: "pwritev2",
		380: "pkey_mprotect",
		381: "pkey_alloc",
		382: "pkey_free",
		383: "statx",
	},
	"ia64": {
		1024: "ni_syscall",
		1025: "exit",
		1026: "read",
		1027: "write",
		1028: "open",
		1029: "close",
		1030: "creat",
		1031: "link",
		1032: "unlink",
		1033: "execve",
		1034: "chdir",
		1035: "fchdir",
		1036: "utimes",
		1037: "mknod",
		1038: "chmod",
		1039: "chown",
		1040: "lseek",
		1041: "getpid",
		1042: "getppid",
		1043: "mount",
		1044: "umount",
		1045: "setuid",
		1046: "getuid",
		1047: "geteuid",
		1048: "ptrace",
		1049: "access",
		1050: "sync",
		1051: "fsync",
		1052: "fdatasync",
		1053: "kill",
		1054: "rename",
		1055: "mkdir",
		1056: "rmdir",
		1057: "dup",
		1058: "pipe",
		1059: "times",
		1060: "brk",
		1061: "setgid",
		1062: "getgid",
		1063: "getegid",
		1064: "acct",
		1065: "ioctl",
		1066: "fcntl",
		1067: "umask",
		1068: "chroot",
		1069: "ustat",
		1070: "dup2",
		1071: "setreuid",
		1072: "setregid",
		1073: "getresuid",
		1074: "setresuid",
		1075: "getresgid",
		1076: "setresgid",
		1077: "getgroups",
		1078: "setgroups",
		1079: "getpgid",
		1080: "setpgid",
		1081: "setsid",
		1082: "getsid",
		1083: "sethostname",
		1084: "setrlimit",
		1085: "getrlimit",
		1086: "getrusage",
		1087: "gettimeofday",
		1088: "settimeofday",
		1089: "select",
		1090: "poll",
		1091: "symlink",
		1092: "readlink",
		1093: "uselib",
		1094: "swapon",
		1095: "swapoff",
		1096: "reboot",
		1097: "truncate",
		1098: "ftruncate",
		1099: "fchmod",
		1100: "fchown",
		1101: "getpriority",
		1102: "setpriority",
		1103: "statfs",
		1104: "fstatfs",
		1105: "gettid",
		1106: "semget",
		1107: "semop",
		1108: "semctl",
		1109: "msgget",
		1110: "msgsnd",
		1111: "msgrcv",
		1112: "msgctl",
		1113: "shmget",
		1114: "shmat",
		1115: "shmdt",
		1116: "shmctl",
		1117: "syslog",
		1118: "setitimer",
		1119: "getitimer",
		1120: "tux",
		1123: "vhangup",
		1124: "lchown",
		1125: "remap_file_pages",
		1126: "wait4",
		1127: "sysinfo",
		1128: "clone",
		1129: "setdomainname",
		1130: "uname",
		1131: "adjtimex",
		1133: "init_module",
		1134: "delete_module",
		1137: "quotactl",
		1138: "bdflush",
		1139: "sysfs",
		1140: "personality",
		1141: "afs_syscall",
		1142: "setfsuid",
		1143: "setfsgid",
		1144: "getdents",
		1145: "flock",
		1146: "readv",
		1147: "writev",
		1148: "pread64",
		1149: "pwrite64",
		1150: "_sysctl",
		1151: "mmap",
		1152: "munmap",
		1153: "mlock",
		1154: "mlockall",
		1155: "mprotect",
		1156: "mremap",
		1157: "msync",
		1158: "munlock",
		1159: "munlockall",
		1160: "sched_getparam",
		1161: "sched_setparam",
		1162: "sched_getscheduler",
		1163: "sched_setscheduler",
		1164: "sched_yield",
		1165: "sched_get_priority_max",
		1166: "sched_get_priority_min",
		1167: "sched_rr_get_interval",
		1168: "nanosleep",
		1169: "nfsservctl",
		1170: "prctl",
		1172: "mmap2",
		1173: "pciconfig_read",
		1174: "pciconfig_write",
		1175: "perfmonctl",
		1176: "sigaltstack",
		1177: "rt_sigaction",
		1178: "rt_sigpending",
		1179: "rt_sigprocmask",
		1180: "rt_sigqueueinfo",
		1181: "rt_sigreturn",
		1182: "rt_sigsuspend",
		1183: "rt_sigtimedwait",
		1184: "getcwd",
		1185: "capget",
		1186: "capset",
		1187: "sendfile",
		1188: "getpmsg",
		1189: "putpmsg",
		1190: "socket",
		1191: "bind",
		1192: "connect",
		1193: "listen",
		1194: "accept",
		1195: "getsockname",
		1196: "getpeername",
		1197: "socketpair",
		1198: "send",
		1199: "sendto",
		1200: "recv",
		1201: "recvfrom",
		1202: "shutdown",
		1203: "setsockopt",
		1204: "getsockopt",
		1205: "sendmsg",
		1206: "recvmsg",
		1207: "pivot_root",
		1208: "mincore",
		1209: "madvise",
		1210: "stat",
		1211: "lstat",
		1212: "fstat",
		1213: "clone2",
		1214: "getdents64",
		1215: "getunwind",
		1216: "readahead",
		1217: "setxattr",
		1218: "lsetxattr",
		1219: "fsetxattr",
		1220: "getxattr",
		1221: "lgetxattr",
		1222: "fgetxattr",
		1223: "listxattr",
		1224: "llistxattr",
		1225: "flistxattr",
		1226: "removexattr",
		1227: "lremovexattr",
		1228: "fremovexattr",
		1229: "tkill",
		1230: "futex",
		1231: "sched_setaffinity",
		1232: "sched_getaffinity",
		1233: "set_tid_address",
		1234: "fadvise64",
		1235: "tgkill",
		1236: "exit_group",
		1237: "lookup_dcookie",
		1238: "io_setup",
		1239: "io_destroy",
		1240: "io_getevents",
		1241: "io_submit",
		1242: "io_cancel",
		1243: "epoll_create",
		1244: "epoll_ctl",
		1245: "epoll_wait",
		1246: "restart_syscall",
		1247: "semtimedop",
		1248: "timer_create",
		1249: "timer_settime",
		1250: "timer_gettime",
		1251: "timer_getoverrun",
		1252: "timer_delete",
		1253: "clock_settime",
		1254: "clock_gettime",
		1255: "clock_getres",
		1256: "clock_nanosleep",
		1257: "fstatfs64",
		1258: "statfs64",
		1259: "mbind",
		1260: "get_mempolicy",
		1261: "set_mempolicy",
		1262: "mq_open",
		1263: "mq_unlink",
		1264: "mq_timedsend",
		1265: "mq_timedreceive",
		1266: "mq_notify",
		1267: "mq_getsetattr",
		1268: "kexec_load",
		1269: "vserver",
		1270: "waitid",
		1271: "add_key",
		1272: "request_key",
		1273: "keyctl",
		1274: "ioprio_set",
		1275: "ioprio_get",
		1276: "set_zone_reclaim",
		1277: "inotify_init",
		1278: "inotify_add_watch",
		1279: "inotify_rm_watch",
		1280: "migrate_pages",
		1281: "openat",
		1282: "mkdirat",
		1283: "mknodat",
		1284: "fchownat",
		1285: "futimesat",
		1286: "newfstatat",
		1287: "unlinkat",
		1288: "renameat",
		1289: "linkat",
		1290: "symlinkat",
		1291: "readlinkat",
		1292: "fchmodat",
		1293: "faccessat",
		1294: "pselect",
		1295: "ppoll",
		1296: "unshare",
		1297: "splice",
		1298: "set_robust_list",
		1299: "get_robust_list",
		1300: "sync_file_range",
		1301: "tee",
		1302: "vmsplice",
		1303: "fallocate",
		1304: "getcpu",
		1305: "epoll_pwait",
		1306: "utimensat",
		1307: "signalfd",
		1308: "timerfd",
		1309: "eventfd",
		1310: "timerfd_create",
		1311: "timerfd_settime",
		1312: "timerfd_gettime",
		1313: "signalfd4",
		1314: "eventfd2",
		1315: "epoll_create1",
		1316: "dup3",
		1317: "pipe2",
		1318: "inotify_init1",
		1319: "preadv",
		1320: "pwritev",
		1321: "rt_tgsigqueueinfo",
		1322: "recvmmsg",
		1323: "fanotify_init",
		1324: "fanotify_mark",
		1325: "prlimit64",
		1326: "name_to_handle_at",
		1327: "open_by_handle_at",
		1328: "clock_adjtime",
		1329: "syncfs",
		1330: "setns",
		1331: "sendmmsg",
		1332: "process_vm_readv",
		1333: "process_vm_writev",
		1334: "accept4",
		1335: "finit_module",
		1336: "sched_setattr",
		1337: "sched_getattr",
		1338: "renameat2",
		1339: "getrandom",
		1340: "memfd_create",
		1341: "bpf",
		1342: "execveat",
		1343: "userfaultfd",
		1344: "membarrier",
		1345: "kcmp",
		1346: "mlock2",
		1347: "copy_file_range",
		1348: "preadv2",
		1349: "pwritev2",
	},
	"ppc": {
		1:   "exit",
		2:   "fork",
		3:   "read",
		4:   "write",
		5:   "open",
		6:   "close",
		7:   "waitpid",
		8:   "creat",
		9:   "link",
		10:  "unlink",
		11:  "execve",
		12:  "chdir",
		13:  "time",
		14:  "mknod",
		15:  "chmod",
		16:  "lchown",
		17:  "break",
		18:  "oldstat",
		19:  "lseek",
		20:  "getpid",
		21:  "mount",
		22:  "umount",
		23:  "setuid",
		24:  "getuid",
		25:  "stime",
		26:  "ptrace",
		27:  "alarm",
		28:  "oldfstat",
		29:  "pause",
		30:  "utime",
		31:  "stty",
		32:  "gtty",
		33:  "access",
		34:  "nice",
		35:  "ftime",
		36:  "sync",
		37:  "kill",
		38:  "rename",
		39:  "mkdir",
		40:  "rmdir",
		41:  "dup",
		42:  "pipe",
		43:  "times",
		44:  "prof",
		45:  "brk",
		46:  "setgid",
		47:  "getgid",
		48:  "signal",
		49:  "geteuid",
		50:  "getegid",
		51:  "acct",
		52:  "umount2",
		53:  "lock",
		54:  "ioctl",
		55:  "fcntl",
		56:  "mpx",
		57:  "setpgid",
		58:  "ulimit",
		59:  "oldolduname",
		60:  "umask",
		61:  "chroot",
		62:  "ustat",
		63:  "dup2",
		64:  "getppid",
		65:  "getpgrp",
		66:  "setsid",
		67:  "sigaction",
		68:  "sgetmask",
		69:  "ssetmask",
		70:  "setreuid",
		71:  "setregid",
		72:  "sigsuspend",
		73:  "sigpending",
		74:  "sethostname",
		75:  "setrlimit",
		76:  "getrlimit",
		77:  "getrusage",
		78:  "gettimeofday",
		79:  "settimeofday",
		80:  "getgroups",
		81:  "setgroups",
		82:  "select",
		83:  "symlink",
		84:  "oldlstat",
		85:  "readlink",
		86:  "uselib",
		87:  "swapon",
		88:  "reboot",
		89:  "readdir",
		90:  "mmap",
		91:  "munmap",
		92:  "truncate",
		93:  "ftruncate",
		94:  "fchmod",
		95:  "fchown",
		96:  "getpriority",
		97:  "setpriority",
		98:  "profil",
		99:  "statfs",
		100: "fstatfs",
		101: "ioperm",
		102: "socketcall",
		103: "syslog",
		104: "setitimer",
		105: "getitimer",
		106: "stat",
		107: "lstat",
		108: "fstat",
		109: "olduname",
		110: "iopl",
		111: "vhangup",
		112: "idle",
		113: "vm86",
		114: "wait4",
		115: "swapoff",
		116: "sysinfo",
		117: "ipc",
		118: "fsync",
		119: "sigreturn",
		120: "clone",
		121: "setdomainname",
		122: "uname",
		123: "modify_ldt",
		124: "adjtimex",
		125: "mprotect",
		126: "sigprocmask",
		127: "create_module",
		128: "init_module",
		129: "delete_module",
		130: "get_kernel_syms",
		131: "quotactl",
		132: "getpgid",
		133: "fchdir",
		134: "bdflush",
		135: "sysfs",
		136: "personality",
		137: "afs_syscall",
		138: "setfsuid",
		139: "setfsgid",
		140: "_llseek",
		141: "getdents",
		142: "_newselect",
		143: "flock",
		144: "msync",
		145: "readv",
		146: "writev",
		147: "getsid",
		148: "fdatasync",
		149: "_sysctl",
		150: "mlock",
		151: "munlock",
		152: "mlockall",
		153: "munlockall",
		154: "sched_setparam",
		155: "sched_getparam",
		156: "sched_setscheduler",
		157: "sched_getscheduler",
		158: "sched_yield",
		159: "sched_get_priority_max",
		160: "sched_get_priority_min",
		161: "sched_rr_get_interval",
		162: "nanosleep",
		163: "mremap",
		164: "setresuid",
		165: "getresuid",
		166: "query_module",
		167: "poll",
		168: "nfsservctl",
		169: "setresgid",
		170: "getresgid",
		171: "prctl",
		172: "rt_sigreturn",
		173: "rt_sigaction",
		174: "rt_sigprocmask",
		175: "rt_sigpending",
		176: "rt_sigtimedwait",
		177: "rt_sigqueueinfo",
		178: "rt_sigsuspend",
		179: "pread",
		180: "pwrite",
		181: "chown",
		182: "getcwd",
		183: "capget",
		184: "capset",
		185: "sigaltstack",
		186: "sendfile",
		187: "getpmsg",
		188: "putpmsg",
		189: "vfork",
		190: "ugetrlimit",
		191: "readahead",
		192: "mmap2",
		193: "truncate64",
		194: "ftruncate64",
		195: "stat64",
		196: "lstat64",
		197: "fstat64",
		198: "pciconfig_read",
		199: "pciconfig_write",
		200: "pciconfig_iobase",
		201: "multiplexer",
		202: "getdents64",
		203: "pivot_root",
		204: "fcntl64",
		205: "madvise",
		206: "mincore",
		207: "gettid",
		208: "tkill",
		209: "setxattr",
		210: "lsetxattr",
		211: "fsetxattr",
		212: "getxattr",
		213: "lgetxattr",
		214: "fgetxattr",
		215: "listxattr",
		216: "llistxattr",
		217: "flistxattr",
		218: "removexattr",
		219: "lremovexattr",
		220: "fremovexattr",
		221: "futex",
		222: "sched_setaffinity",
		223: "sched_getaffinity",
		225: "tuxcall",
		226: "sendfile64",
		227: "io_setup",
		228: "io_destroy",
		229: "io_getevents",
		230: "io_submit",
		231: "io_cancel",
		232: "set_tid_address",
		233: "fadvise64",
		234: "exit_group",
		235: "lookup_dcookie",
		236: "epoll_create",
		237: "epoll_ctl",
		238: "epoll_wait",
		239: "remap_file_pages",
		240: "timer_create",
		241: "timer_settime",
		242: "timer_gettime",
		243: "timer_getoverrun",
		244: "timer_delete",
		245: "clock_settime",
		246: "clock_gettime",
		247: "clock_getres",
		248: "clock_nanosleep",
		249: "swapcontext",
		250: "tgkill",
		251: "utimes",
		252: "statfs64",
		253: "fstatfs64",
		254: "fadvise64_64",
		255: "rtas",
		262: "mq_open",
		263: "mq_unlink",
		264: "mq_timedsend",
		265: "mq_timedreceive",
		266: "mq_notify",
		267: "mq_getsetattr",
		268: "kexec_load",
		269: "add_key",
		270: "request_key",
		271: "keyctl",
		272: "waitid",
		273: "ioprio_set",
		274: "ioprio_get",
		275: "inotify_init",
		276: "inotify_add_watch",
		277: "inotify_rm_watch",
		278: "spu_run",
		279: "spu_create",
		280: "pselect6",
		281: "ppoll",
		282: "unshare",
		283: "splice",
		284: "tee",
		285: "vmsplice",
		286: "openat",
		287: "mkdirat",
		288: "mknodat",
		289: "fchownat",
		290: "futimesat",
		291: "fstatat64",
		292: "unlinkat",
		293: "renameat",
		294: "linkat",
		295: "symlinkat",
		296: "readlinkat",
		297: "fchmodat",
		298: "faccessat",
		299: "get_robust_list",
		300: "set_robust_list",
		301: "move_pages",
		302: "getcpu",
		303: "epoll_pwait",
		304: "utimensat",
		305: "signalfd",
		306: "timerfd",
		307: "eventfd",
		308: "sync_file_range2",
		309: "fallocate",
		310: "subpage_prot",
		311: "timerfd_settime",
		312: "timerfd_gettime",
		313: "signalfd4",
		314: "eventfd2",
		315: "epoll_create1",
		316: "dup3",
		317: "pipe2",
		318: "inotify_init1",
		319: "perf_counter_open",
		320: "preadv",
		321: "pwritev",
		322: "rt_tgsigqueueinfo",
		323: "fanotify_init",
		324: "fanotify_mark",
		325: "prlimit64",
		326: "socket",
		327: "bind",
		328: "connect",
		329: "listen",
		330: "accept",
		331: "getsockname",
		332: "getpeername",
		333: "socketpair",
		334: "send",
		335: "sendto",
		336: "recv",
		337: "recvfrom",
		338: "shutdown",
		339: "setsockopt",
		340: "getsockopt",
		341: "sendmsg",
		342: "recvmsg",
		343: "recvmmsg",
		344: "accept4",
		345: "name_to_handle_at",
		346: "open_by_handle_at",
		347: "clock_adjtime",
		348: "syncfs",
		349: "sendmmsg",
		350: "setns",
		351: "process_vm_readv",
		352: "process_vm_writev",
		353: "finit_module",
		354: "kcmp",
		355: "sched_setattr",
		356: "sched_getattr",
		357: "renameat2",
		358: "seccomp",
		359: "getrandom",
		360: "memfd_create",
		361: "bpf",
		362: "execveat",
		363: "switch_endian",
		364: "userfaultfd",
		365: "membarrier",
		378: "mlock2",
		379: "copy_file_range",
		380: "preadv2",
		381: "pwritev2",
		382: "kexec_file_load",
		383: "statx",
	},
	"s390": {
		1:   "exit",
		2:   "fork",
		3:   "read",
		4:   "write",
		5:   "open",
		6:   "close",
		8:   "creat",
		9:   "link",
		10:  "unlink",
		11:  "execve",
		12:  "chdir",
		13:  "time",
		14:  "mknod",
		15:  "chmod",
		16:  "lchown",
		19:  "lseek",
		20:  "getpid",
		21:  "mount",
		22:  "umount",
		23:  "setuid",
		24:  "getuid",
		25:  "stime",
		26:  "ptrace",
		27:  "alarm",
		29:  "pause",
		30:  "utime",
		33:  "access",
		34:  "nice",
		36:  "sync",
		37:  "kill",
		38:  "rename",
		39:  "mkdir",
		40:  "rmdir",
		41:  "dup",
		42:  "pipe",
		43:  "times",
		45:  "brk",
		46:  "setgid",
		47:  "getgid",
		48:  "signal",
		49:  "geteuid",
		50:  "getegid",
		51:  "acct",
		52:  "umount2",
		54:  "ioctl",
		55:  "fcntl",
		57:  "setpgid",
		60:  "umask",
		61:  "chroot",
		62:  "ustat",
		63:  "dup2",
		64:  "getppid",
		65:  "getpgrp",
		66:  "setsid",
		67:  "sigaction",
		70:  "setreuid",
		71:  "setregid",
		72:  "sigsuspend",
		73:  "sigpending",
		74:  "sethostname",
		75:  "setrlimit",
		76:  "getrlimit",
		77:  "getrusage",
		78:  "gettimeofday",
		79:  "settimeofday",
		80:  "getgroups",
		81:  "setgroups",
		83:  "symlink",
		85:  "readlink",
		86:  "uselib",
		87:  "swapon",
		88:  "reboot",
		89:  "readdir",
		90:  "mmap",
		91:  "munmap",
		92:  "truncate",
		93:  "ftruncate",
		94:  "fchmod",
		95:  "fchown",
		96:  "getpriority",
		97:  "setpriority",
		99:  "statfs",
		100: "fstatfs",
		101: "ioperm",
		102: "socketcall",
		103: "syslog",
		104: "setitimer",
		105: "getitimer",
		106: "stat",
		107: "lstat",
		108: "fstat",
		111: "vhangup",
		112: "idle",
		114: "wait4",
		115: "swapoff",
		116: "sysinfo",
		117: "ipc",
		118: "fsync",
		119: "sigreturn",
		120: "clone",
		121: "setdomainname",
		122: "uname",
		124: "adjtimex",
		125: "mprotect",
		126: "sigprocmask",
		127: "create_module",
		128: "init_module",
		129: "delete_module",
		130: "get_kernel_syms",
		131: "quotactl",
		132: "getpgid",
		133: "fchdir",
		134: "bdflush",
		135: "sysfs",
		136: "personality",
		137: "afs_syscall",
		138: "setfsuid",
		139: "setfsgid",
		140: "_llseek",
		141: "getdents",
		142: "_newselect",
		143: "flock",
		144: "msync",
		145: "readv",
		146: "writev",
		147: "getsid",
		148: "fdatasync",
		149: "_sysctl",
		150: "mlock",
		151: "munlock",
		152: "mlockall",
		153: "munlockall",
		154: "sched_setparam",
		155: "sched_getparam",
		156: "sched_setscheduler",
		157: "sched_getscheduler",
		158: "sched_yield",
		159: "sched_get_priority_max",
		160: "sched_get_priority_min",
		161: "sched_rr_get_interval",
		162: "nanosleep",
		163: "mremap",
		164: "setresuid",
		165: "getresuid",
		167: "query_module",
		168: "poll",
		169: "nfsservctl",
		170: "setresgid",
		171: "getresgid",
		172: "prctl",
		173: "rt_sigreturn",
		174: "rt_sigaction",
		175: "rt_sigprocmask",
		176: "rt_sigpending",
		177: "rt_sigtimedwait",
		178: "rt_sigqueueinfo",
		179: "rt_sigsuspend",
		180: "pread",
		181: "pwrite",
		182: "chown",
		183: "getcwd",
		184: "capget",
		185: "capset",
		186: "sigaltstack",
		187: "sendfile",
		188: "getpmsg",
		189: "putpmsg",
		190: "vfork",
		191: "ugetrlimit",
		192: "mmap2",
		193: "truncate64",
		194: "ftruncate64",
		195: "stat64",
		196: "lstat64",
		197: "fstat64",
		198: "lchown32",
		199: "getuid32",
		200: "getgid32",
		201: "geteuid32",
		202: "getegid32",
		203: "setreuid32",
		204: "setregid32",
		205: "getgroups32",
		206: "setgroups32",
		207: "fchown32",
		208: "setresuid32",
		209: "getresuid32",
		210: "setresgid32",
		211: "getresgid32",
		212: "chown32",
		213: "setuid32",
		214: "setgid32",
		215: "setfsuid32",
		216: "setfsgid32",
		217: "pivot_root",
		218: "mincore",
		219: "madvise",
		220: "getdents64",
		221: "fcntl64",
		222: "readahead",
		223: "sendfile64",
		224: "setxattr",
		225: "lsetxattr",
		226: "fsetxattr",
		227: "getxattr",
		228: "lgetxattr",
		229: "fgetxattr",
		230: "listxattr",
		231: "llistxattr",
		232: "flistxattr",
		233: "removexattr",
		234: "lremovexattr",
		235: "fremovexattr",
		236: "gettid",
		237: "tkill",
		238: "futex",
		239: "sched_setaffinity",
		240: "sched_getaffinity",
		241: "tgkill",
		243: "io_setup",
		244: "io_destroy",
		245: "io_getevents",
		246: "io_submit",
		247: "io_cancel",
		248: "exit_group",
		249: "epoll_create",
		250: "epoll_ctl",
		251: "epoll_wait",
		252: "set_tid_address",
		253: "fadvise64",
		254: "timer_create",
		255: "timer_settime",
		256: "timer_gettime",
		257: "timer_getoverrun",
		258: "timer_delete",
		259: "clock_settime",
		260: "clock_gettime",
		261: "clock_getres",
		262: "clock_nanosleep",
		264: "fadvise64_64",
		265: "statfs64",
		266: "fstatfs64",
		267: "remap_file_pages",
		271: "mq_open",
		272: "mq_unlink",
		273: "mq_timedsend",
		274: "mq_timedreceive",
		275: "mq_notify",
		276: "mq_getsetattr",
		277: "kexec_load",
		278: "add_key",
		279: "request_key",
		280: "keyctl",
		281: "waitid",
		282: "ioprio_set",
		283: "ioprio_get",
		284: "inotify_init",
		285: "inotify_add_watch",
		286: "inotify_rm_watch",
		288: "openat",
		289: "mkdirat",
		290: "mknodat",
		291: "fchownat",
		292: "futimesat",
		293: "fstatat64",
		294: "unlinkat",
		295: "renameat",
		296: "linkat",
		297: "symlinkat",
		298: "readlinkat",
		299: "fchmodat",
		300: "faccessat",
		301: "pselect6",
		302: "ppoll",
		303: "unshare",
		304: "set_robust_list",
		305: "get_robust_list",
		306: "splice",
		307: "sync_file_range",
		308: "tee",
		309: "vmsplice",
		311: "getcpu",
		312: "epoll_pwait",
		313: "utimes",
		314: "fallocate",
		315: "utimensat",
		316: "signalfd",
		317: "timerfd",
		318: "eventfd",
		319: "timerfd_create",
		320: "timerfd_settime",
		321: "timerfd_gettime",
		322: "signalfd4",
		323: "eventfd2",
		324: "inotify_init1",
		325: "pipe2",
		326: "dup3",
		327: "epoll_create1",
		328: "preadv",
		329: "pwritev",
		330: "rt_tgsigqueueinfo",
		331: "perf_event_open",
		332: "fanotify_init",
		333: "fanotify_mark",
		334: "prlimit64",
		335: "name_to_handle_at",
		336: "open_by_handle_at",
		337: "clock_adjtime",
		338: "syncfs",
		339: "setns",
		340: "process_vm_readv",
		341: "process_vm_writev",
		342: "s390_runtime_instr",
		343: "kcmp",
		344: "finit_module",
		345: "sched_setattr",
		346: "sched_getattr",
		347: "renameat2",
		348: "seccomp",
		349: "getrandom",
		350: "memfd_create",
		351: "bpf",
		352: "s390_pci_mmio_write",
		353: "s390_pci_mmio_read",
		354: "execveat",
		355: "userfaultfd",
		356: "membarrier",
		357: "recvmmsg",
		358: "sendmmsg",
		359: "socket",
		360: "socketpair",
		361: "bind",
		362: "connect",
		363: "listen",
		364: "accept4",
		365: "getsockopt",
		366: "setsockopt",
		367: "getsockname",
		368: "getpeername",
		369: "sendto",
		370: "sendmsg",
		371: "recvfrom",
		372: "recvmsg",
		373: "shutdown",
		374: "mlock2",
		375: "copy_file_range",
		376: "preadv2",
		377: "pwritev2",
		379: "statx",
	},
	"s390x": {
		1:   "exit",
		2:   "fork",
		3:   "read",
		4:   "write",
		5:   "open",
		6:   "close",
		8:   "creat",
		9:   "link",
		10:  "unlink",
		11:  "execve",
		12:  "chdir",
		14:  "mknod",
		15:  "chmod",
		19:  "lseek",
		20:  "getpid",
		21:  "mount",
		22:  "umount",
		26:  "ptrace",
		27:  "alarm",
		29:  "pause",
		30:  "utime",
		33:  "access",
		34:  "nice",
		36:  "sync",
		37:  "kill",
		38:  "rename",
		39:  "mkdir",
		40:  "rmdir",
		41:  "dup",
		42:  "pipe",
		43:  "times",
		45:  "brk",
		48:  "signal",
		51:  "acct",
		52:  "umount2",
		54:  "ioctl",
		55:  "fcntl",
		57:  "setpgid",
		60:  "umask",
		61:  "chroot",
		62:  "ustat",
		63:  "dup2",
		64:  "getppid",
		65:  "getpgrp",
		66:  "setsid",
		67:  "sigaction",
		72:  "sigsuspend",
		73:  "sigpending",
		74:  "sethostname",
		75:  "setrlimit",
		77:  "getrusage",
		78:  "gettimeofday",
		79:  "settimeofday",
		83:  "symlink",
		85:  "readlink",
		86:  "uselib",
		87:  "swapon",
		88:  "reboot",
		89:  "readdir",
		90:  "mmap",
		91:  "munmap",
		92:  "truncate",
		93:  "ftruncate",
		94:  "fchmod",
		96:  "getpriority",
		97:  "setpriority",
		99:  "statfs",
		100: "fstatfs",
		102: "socketcall",
		103: "syslog",
		104: "setitimer",
		105: "getitimer",
		106: "stat",
		107: "lstat",
		108: "fstat",
		111: "vhangup",
		112: "idle",
		114: "wait4",
		115: "swapoff",
		116: "sysinfo",
		117: "ipc",
		118: "fsync",
		119: "sigreturn",
		120: "clone",
		121: "setdomainname",
		122: "uname",
		124: "adjtimex",
		125: "mprotect",
		126: "sigprocmask",
		127: "create_module",
		128: "init_module",
		129: "delete_module",
		130: "get_kernel_syms",
		131: "quotactl",
		132: "getpgid",
		133: "fchdir",
		134: "bdflush",
		135: "sysfs",
		136: "personality",
		137: "afs_syscall",
		141: "getdents",
		142: "select",
		143: "flock",
		144: "msync",
		145: "readv",
		146: "writev",
		147: "getsid",
		148: "fdatasync",
		149: "_sysctl",
		150: "mlock",
		151: "munlock",
		152: "mlockall",
		153: "munlockall",
		154: "sched_setparam",
		155: "sched_getparam",
		156: "sched_setscheduler",
		157: "sched_getscheduler",
		158: "sched_yield",
		159: "sched_get_priority_max",
		160: "sched_get_priority_min",
		161: "sched_rr_get_interval",
		162: "nanosleep",
		163: "mremap",
		167: "query_module",
		168: "poll",
		169: "nfsservctl",
		172: "prctl",
		173: "rt_sigreturn",
		174: "rt_sigaction",
		175: "rt_sigprocmask",
		176: "rt_sigpending",
		177: "rt_sigtimedwait",
		178: "rt_sigqueueinfo",
		179: "rt_sigsuspend",
		180: "pread",
		181: "pwrite",
		183: "getcwd",
		184: "capget",
		185: "capset",
		186: "sigaltstack",
		187: "sendfile",
		188: "getpmsg",
		189: "putpmsg",
		190: "vfork",
		191: "getrlimit",
		198: "lchown",
		199: "getuid",
		200: "getgid",
		201: "geteuid",
		202: "getegid",
		203: "setreuid",
		204: "setregid",
		205: "getgroups",
		206: "setgroups",
		207: "fchown",
		208: "setresuid",
		209: "getresuid",
		210: "setresgid",
		211: "getresgid",
		212: "chown",
		213: "setuid",
		214: "setgid",
		215: "setfsuid",
		216: "setfsgid",
		217: "pivot_root",
		218: "mincore",
		219: "madvise",
		222: "readahead",
		224: "setxattr",
		225: "lsetxattr",
		226: "fsetxattr",
		227: "getxattr",
		228: "lgetxattr",
		229: "fgetxattr",
		230: "listxattr",
		231: "llistxattr",
		232: "flistxattr",
		233: "removexattr",
		234: "lremovexattr",
		235: "fremovexattr",
		236: "gettid",
		237: "tkill",
		238: "futex",
		239: "sched_setaffinity",
		240: "sched_getaffinity",
		241: "tgkill",
		243: "io_setup",
		244: "io_destroy",
		245: "io_getevents",
		246: "io_submit",
		247: "io_cancel",
		248: "exit_group",
		249: "epoll_create",
		250: "epoll_ctl",
		251: "epoll_wait",
		252: "set_tid_address",
		253: "fadvise64",
		254: "timer_create",
		255: "timer_settime",
		256: "timer_gettime",
		257: "timer_getoverrun",
		258: "timer_delete",
		259: "clock_settime",
		260: "clock_gettime",
		261: "clock_getres",
		262: "clock_nanosleep",
		265: "statfs64",
		266: "fstatfs64",
		267: "remap_file_pages",
		271: "mq_open",
		272: "mq_unlink",
		273: "mq_timedsend",
		274: "mq_timedreceive",
		275: "mq_notify",
		276: "mq_getsetattr",
		277: "kexec_load",
		278: "add_key",
		279: "request_key",
		280: "keyctl",
		281: "waitid",
		282: "ioprio_set",
		283: "ioprio_get",
		284: "inotify_init",
		285: "inotify_add_watch",
		286: "inotify_rm_watch",
		288: "openat",
		289: "mkdirat",
		290: "mknodat",
		291: "fchownat",
		292: "futimesat",
		293: "newfstatat",
		294: "unlinkat",
		295: "renameat",
		296: "linkat",
		297: "symlinkat",
		298: "readlinkat",
		299: "fchmodat",
		300: "faccessat",
		301: "pselect6",
		302: "ppoll",
		303: "unshare",
		304: "set_robust_list",
		305: "get_robust_list",
		306: "splice",
		307: "sync_file_range",
		308: "tee",
		309: "vmsplice",
		311: "getcpu",
		312: "epoll_pwait",
		313: "utimes",
		314: "fallocate",
		315: "utimensat",
		316: "signalfd",
		317: "timerfd",
		318: "eventfd",
		319: "timerfd_create",
		320: "timerfd_settime",
		321: "timerfd_gettime",
		322: "signalfd4",
		323: "eventfd2",
		324: "inotify_init1",
		325: "pipe2",
		326: "dup3",
		327: "epoll_create1",
		328: "preadv",
		329: "pwritev",
		330: "rt_tgsigqueueinfo",
		331: "perf_event_open",
		332: "fanotify_init",
		333: "fanotify_mark",
		334: "prlimit64",
		335: "name_to_handle_at",
		336: "open_by_handle_at",
		337: "clock_adjtime",
		338: "syncfs",
		339: "setns",
		340: "process_vm_readv",
		341: "process_vm_writev",
		342: "s390_runtime_instr",
		343: "kcmp",
		344: "finit_module",
		345: "sched_setattr",
		346: "sched_getattr",
		347: "renameat2",
		348: "seccomp",
		349: "getrandom",
		350: "memfd_create",
		351: "bpf",
		352: "s390_pci_mmio_write",
		353: "s390_pci_mmio_read",
		354: "execveat",
		355: "userfaultfd",
		356: "membarrier",
		357: "recvmmsg",
		358: "sendmmsg",
		359: "socket",
		360: "socketpair",
		361: "bind",
		362: "connect",
		363: "listen",
		364: "accept4",
		365: "getsockopt",
		366: "setsockopt",
		367: "getsockname",
		368: "getpeername",
		369: "sendto",
		370: "sendmsg",
		371: "recvfrom",
		372: "recvmsg",
		373: "shutdown",
		374: "mlock2",
		375: "copy_file_range",
		376: "preadv2",
		377: "pwritev2",
		379: "statx",
	},
	"x86_64": {
		0:   "read",
		1:   "write",
		2:   "open",
		3:   "close",
		4:   "stat",
		5:   "fstat",
		6:   "lstat",
		7:   "poll",
		8:   "lseek",
		9:   "mmap",
		10:  "mprotect",
		11:  "munmap",
		12:  "brk",
		13:  "rt_sigaction",
		14:  "rt_sigprocmask",
		15:  "rt_sigreturn",
		16:  "ioctl",
		17:  "pread",
		18:  "pwrite",
		19:  "readv",
		20:  "writev",
		21:  "access",
		22:  "pipe",
		23:  "select",
		24:  "sched_yield",
		25:  "mremap",
		26:  "msync",
		27:  "mincore",
		28:  "madvise",
		29:  "shmget",
		30:  "shmat",
		31:  "shmctl",
		32:  "dup",
		33:  "dup2",
		34:  "pause",
		35:  "nanosleep",
		36:  "getitimer",
		37:  "alarm",
		38:  "setitimer",
		39:  "getpid",
		40:  "sendfile",
		41:  "socket",
		42:  "connect",
		43:  "accept",
		44:  "sendto",
		45:  "recvfrom",
		46:  "sendmsg",
		47:  "recvmsg",
		48:  "shutdown",
		49:  "bind",
		50:  "listen",
		51:  "getsockname",
		52:  "getpeername",
		53:  "socketpair",
		54:  "setsockopt",
		55:  "getsockopt",
		56:  "clone",
		57:  "fork",
		58:  "vfork",
		59:  "execve",
		60:  "exit",
		61:  "wait4",
		62:  "kill",
		63:  "uname",
		64:  "semget",
		65:  "semop",
		66:  "semctl",
		67:  "shmdt",
		68:  "msgget",
		69:  "msgsnd",
		70:  "msgrcv",
		71:  "msgctl",
		72:  "fcntl",
		73:  "flock",
		74:  "fsync",
		75:  "fdatasync",
		76:  "truncate",
		77:  "ftruncate",
		78:  "getdents",
		79:  "getcwd",
		80:  "chdir",
		81:  "fchdir",
		82:  "rename",
		83:  "mkdir",
		84:  "rmdir",
		85:  "creat",
		86:  "link",
		87:  "unlink",
		88:  "symlink",
		89:  "readlink",
		90:  "chmod",
		91:  "fchmod",
		92:  "chown",
		93:  "fchown",
		94:  "lchown",
		95:  "umask",
		96:  "gettimeofday",
		97:  "getrlimit",
		98:  "getrusage",
		99:  "sysinfo",
		100: "times",
		101: "ptrace",
		102: "getuid",
		103: "syslog",
		104: "getgid",
		105: "setuid",
		106: "setgid",
		107: "geteuid",
		108: "getegid",
		109: "setpgid",
		110: "getppid",
		111: "getpgrp",
		112: "setsid",
		113: "setreuid",
		114: "setregid",
		115: "getgroups",
		116: "setgroups",
		117: "setresuid",
		118: "getresuid",
		119: "setresgid",
		120: "getresgid",
		121: "getpgid",
		122: "setfsuid",
		123: "setfsgid",
		124: "getsid",
		125: "capget",
		126: "capset",
		127: "rt_sigpending",
		128: "rt_sigtimedwait",
		129: "rt_sigqueueinfo",
		130: "rt_sigsuspend",
		131: "sigaltstack",
		132: "utime",
		133: "mknod",
		134: "uselib",
		135: "personality",
		136: "ustat",
		137: "statfs",
		138: "fstatfs",
		139: "sysfs",
		140: "getpriority",
		141: "setpriority",
		142: "sched_setparam",
		143: "sched_getparam",
		144: "sched_setscheduler",
		145: "sched_getscheduler",
		146: "sched_get_priority_max",
		147: "sched_get_priority_min",
		148: "sched_rr_get_interval",
		149: "mlock",
		150: "munlock",
		151: "mlockall",
		152: "munlockall",
		153: "vhangup",
		154: "modify_ldt",
		155: "pivot_root",
		156: "_sysctl",
		157: "prctl",
		158: "arch_prctl",
		159: "adjtimex",
		160: "setrlimit",
		161: "chroot",
		162: "sync",
		163: "acct",
		164: "settimeofday",
		165: "mount",
		166: "umount2",
		167: "swapon",
		168: "swapoff",
		169: "reboot",
		170: "sethostname",
		171: "setdomainname",
		172: "iopl",
		173: "ioperm",
		174: "create_module",
		175: "init_module",
		176: "delete_module",
		177: "get_kernel_syms",
		178: "query_module",
		179: "quotactl",
		180: "nfsservctl",
		181: "getpmsg",
		182: "putpmsg",
		183: "afs_syscall",
		184: "tuxcall",
		185: "security",
		186: "gettid",
		187: "readahead",
		188: "setxattr",
		189: "lsetxattr",
		190: "fsetxattr",
		191: "getxattr",
		192: "lgetxattr",
		193: "fgetxattr",
		194: "listxattr",
		195: "llistxattr",
		196: "flistxattr",
		197: "removexattr",
		198: "lremovexattr",
		199: "fremovexattr",
		200: "tkill",
		201: "time",
		202: "futex",
		203: "sched_setaffinity",
		204: "sched_getaffinity",
		205: "set_thread_area",
		206: "io_setup",
		207: "io_destroy",
		208: "io_getevents",
		209: "io_submit",
		210: "io_cancel",
		211: "get_thread_area",
		212: "lookup_dcookie",
		213: "epoll_create",
		214: "epoll_ctl_old",
		215: "epoll_wait_old",
		216: "remap_file_pages",
		217: "getdents64",
		218: "set_tid_address",
		219: "restart_syscall",
		220: "semtimedop",
		221: "fadvise64",
		222: "timer_create",
		223: "timer_settime",
		224: "timer_gettime",
		225: "timer_getoverrun",
		226: "timer_delete",
		227: "clock_settime",
		228: "clock_gettime",
		229: "clock_getres",
		230: "clock_nanosleep",
		231: "exit_group",
		232: "epoll_wait",
		233: "epoll_ctl",
		234: "tgkill",
		235: "utimes",
		236: "vserver",
		237: "mbind",
		238: "set_mempolicy",
		239: "get_mempolicy",
		240: "mq_open",
		241: "mq_unlink",
		242: "mq_timedsend",
		243: "mq_timedreceive",
		244: "mq_notify",
		245: "mq_getsetattr",
		246: "kexec_load",
		247: "waitid",
		248: "add_key",
		249: "request_key",
		250: "keyctl",
		251: "ioprio_set",
		252: "ioprio_get",
		253: "inotify_init",
		254: "inotify_add_watch",
		255: "inotify_rm_watch",
		256: "migrate_pages",
		257: "openat",
		258: "mkdirat",
		259: "mknodat",
		260: "fchownat",
		261: "futimesat",
		262: "newfstatat",
		263: "unlinkat",
		264: "renameat",
		265: "linkat",
		266: "symlinkat",
		267: "readlinkat",
		268: "fchmodat",
		269: "faccessat",
		270: "pselect6",
		271: "ppoll",
		272: "unshare",
		273: "set_robust_list",
		274: "get_robust_list",
		275: "splice",
		276: "tee",
		277: "sync_file_range",
		278: "vmsplice",
		279: "move_pages",
		280: "utimensat",
		281: "epoll_pwait",
		282: "signalfd",
		283: "timerfd",
		284: "eventfd",
		285: "fallocate",
		286: "timerfd_settime",
		287: "timerfd_gettime",
		288: "accept4",
		289: "signalfd4",
		290: "eventfd2",
		291: "epoll_create1",
		292: "dup3",
		293: "pipe2",
		294: "inotify_init1",
		295: "preadv",
		296: "pwritev",
		297: "rt_tgsigqueueinfo",
		298: "perf_event_open",
		299: "recvmmsg",
		300: "fanotify_init",
		301: "fanotify_mark",
		302: "prlimit64",
		303: "name_to_handle_at",
		304: "open_by_handle_at",
		305: "clock_adjtime",
		306: "syncfs",
		307: "sendmmsg",
		308: "setns",
		309: "getcpu",
		310: "process_vm_readv",
		311: "process_vm_writev",
		312: "kcmp",
		313: "finit_module",
		314: "sched_setattr",
		315: "sched_getattr",
		316: "renameat2",
		317: "seccomp",
		318: "getrandom",
		319: "memfd_create",
		320: "kexec_file_load",
		321: "bpf",
		322: "execveat",
		323: "userfaultfd",
		324: "membarrier",
		325: "mlock2",
		326: "copy_file_range",
		327: "preadv2",
		328: "pwritev2",
		329: "pkey_mprotect",
		330: "pkey_alloc",
		331: "pkey_free",
		332: "statx",
	},
}

AuditSyscalls is a mapping of arch names to tables of syscall numbers to names. For example, x86_64 -> 165 = "mount".

Functions

This section is empty.

Types

type AuditArch added in v0.0.4

type AuditArch uint32
const (
	AUDIT_ARCH_AARCH64     AuditArch = 0xc00000b7
	AUDIT_ARCH_ARM         AuditArch = 0x40000028
	AUDIT_ARCH_ARMEB       AuditArch = 0x28
	AUDIT_ARCH_CRIS        AuditArch = 0x4000004c
	AUDIT_ARCH_FRV         AuditArch = 0x5441
	AUDIT_ARCH_I386        AuditArch = 0x40000003
	AUDIT_ARCH_IA64        AuditArch = 0xc0000032
	AUDIT_ARCH_M32R        AuditArch = 0x58
	AUDIT_ARCH_M68K        AuditArch = 0x4
	AUDIT_ARCH_MIPS        AuditArch = 0x8
	AUDIT_ARCH_MIPS64      AuditArch = 0x80000008
	AUDIT_ARCH_MIPS64N32   AuditArch = 0xa0000008
	AUDIT_ARCH_MIPSEL      AuditArch = 0x40000008
	AUDIT_ARCH_MIPSEL64    AuditArch = 0xc0000008
	AUDIT_ARCH_MIPSEL64N32 AuditArch = 0xe0000008
	AUDIT_ARCH_PARISC      AuditArch = 0xf
	AUDIT_ARCH_PARISC64    AuditArch = 0x8000000f
	AUDIT_ARCH_PPC         AuditArch = 0x14
	AUDIT_ARCH_PPC64       AuditArch = 0x80000015
	AUDIT_ARCH_PPC64LE     AuditArch = 0xc0000015
	AUDIT_ARCH_S390        AuditArch = 0x16
	AUDIT_ARCH_S390X       AuditArch = 0x80000016
	AUDIT_ARCH_SH          AuditArch = 0x2a
	AUDIT_ARCH_SH64        AuditArch = 0x8000002a
	AUDIT_ARCH_SHEL        AuditArch = 0x4000002a
	AUDIT_ARCH_SHEL64      AuditArch = 0xc000002a
	AUDIT_ARCH_SPARC       AuditArch = 0x2
	AUDIT_ARCH_SPARC64     AuditArch = 0x8000002b
	AUDIT_ARCH_X86_64      AuditArch = 0xc000003e
)

func (AuditArch) String added in v0.0.4

func (a AuditArch) String() string

type AuditMessage

type AuditMessage struct {
	RecordType AuditMessageType // Record type from netlink header.
	Timestamp  time.Time        // Timestamp parsed from payload in netlink message.
	Sequence   uint32           // Sequence parsed from payload.
	RawData    string           // Raw message as a string.
	// contains filtered or unexported fields
}

AuditMessage represents a single audit message.

func Parse

func Parse(typ AuditMessageType, message string) (*AuditMessage, error)

Parse parses an audit message in the format it was received from the kernel. It expects a message type, which is the message type value from the netlink header, and a message, which is raw data from the netlink message. The message should begin the the audit header that contains the timestamp and sequence number -- "audit(1488862769.030:19469538)".

A non-nil error is returned if it fails to parse the message header (timestamp, sequence).

func ParseLogLine

func ParseLogLine(line string) (*AuditMessage, error)

ParseLogLine parses an audit message as logged by the Linux audit daemon. It expects logs line that begin with the message type. For example, "type=SYSCALL msg=audit(1488862769.030:19469538)". A non-nil error is returned if it fails to parse the message header (type, timestamp, sequence).

Example

ExampleParseLogLine demonstrates parsing a log line from auditd and shows what the parsed data looks like.

msg, err := ParseLogLine(syscallLogLine)
if err != nil {
	return
}

evt, err := json.MarshalIndent(msg.ToMapStr(), "", "  ")
if err != nil {
	return
}

fmt.Println(string(evt))
Output:

{
  "@timestamp": "2017-03-21 23:12:51.011 +0000 UTC",
  "a0": "15",
  "a1": "7ffd83722200",
  "a2": "6e",
  "a3": "ea60",
  "arch": "x86_64",
  "auid": "unset",
  "comm": "master",
  "egid": "0",
  "euid": "0",
  "exe": "/usr/libexec/postfix/master",
  "exit": "0",
  "fsgid": "0",
  "fsuid": "0",
  "gid": "0",
  "items": "1",
  "pid": "1229",
  "ppid": "1",
  "raw_msg": "audit(1490137971.011:50406): arch=c000003e syscall=42 success=yes exit=0 a0=15 a1=7ffd83722200 a2=6e a3=ea60 items=1 ppid=1 pid=1229 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm=\"master\" exe=\"/usr/libexec/postfix/master\" subj=system_u:system_r:postfix_master_t:s0 key=(null)",
  "record_type": "SYSCALL",
  "result": "success",
  "sequence": "50406",
  "ses": "unset",
  "sgid": "0",
  "subj_domain": "postfix_master_t",
  "subj_level": "s0",
  "subj_role": "system_r",
  "subj_user": "system_u",
  "suid": "0",
  "syscall": "connect",
  "tty": "(none)",
  "uid": "0"
}

func (*AuditMessage) Data

func (m *AuditMessage) Data() (map[string]string, error)

Data returns the key-value pairs that are contained in the audit message. This information is parsed from the raw message text the first time this method is called, all future invocations return the stored result. A nil map may be returned error is non-nil. A non-nil error is returned if there was a failure parsing or enriching the data.

func (*AuditMessage) Tags added in v0.0.7

func (m *AuditMessage) Tags() ([]string, error)

func (*AuditMessage) ToMapStr

func (m *AuditMessage) ToMapStr() map[string]interface{}

ToMapStr returns a new map containing the parsed key value pairs, the record_type, @timestamp, and sequence. The parsed key value pairs have a lower precedence than the well-known keys and will not override them. If an error occurred while parsing the message then an error key will be present.

type AuditMessageType

type AuditMessageType uint16

AuditMessageType represents an audit message type used by the kernel.

const (
	AUDIT_GET                      AuditMessageType = 1000
	AUDIT_SET                      AuditMessageType = 1001
	AUDIT_LIST                     AuditMessageType = 1002
	AUDIT_ADD                      AuditMessageType = 1003
	AUDIT_DEL                      AuditMessageType = 1004
	AUDIT_USER                     AuditMessageType = 1005
	AUDIT_LOGIN                    AuditMessageType = 1006
	AUDIT_WATCH_INS                AuditMessageType = 1007
	AUDIT_WATCH_REM                AuditMessageType = 1008
	AUDIT_WATCH_LIST               AuditMessageType = 1009
	AUDIT_SIGNAL_INFO              AuditMessageType = 1010
	AUDIT_ADD_RULE                 AuditMessageType = 1011
	AUDIT_DEL_RULE                 AuditMessageType = 1012
	AUDIT_LIST_RULES               AuditMessageType = 1013
	AUDIT_TRIM                     AuditMessageType = 1014
	AUDIT_MAKE_EQUIV               AuditMessageType = 1015
	AUDIT_TTY_GET                  AuditMessageType = 1016
	AUDIT_TTY_SET                  AuditMessageType = 1017
	AUDIT_SET_FEATURE              AuditMessageType = 1018
	AUDIT_GET_FEATURE              AuditMessageType = 1019
	AUDIT_USER_AUTH                AuditMessageType = 1100
	AUDIT_USER_ACCT                AuditMessageType = 1101
	AUDIT_USER_MGMT                AuditMessageType = 1102
	AUDIT_CRED_ACQ                 AuditMessageType = 1103
	AUDIT_CRED_DISP                AuditMessageType = 1104
	AUDIT_USER_START               AuditMessageType = 1105
	AUDIT_USER_END                 AuditMessageType = 1106
	AUDIT_USER_AVC                 AuditMessageType = 1107
	AUDIT_USER_CHAUTHTOK           AuditMessageType = 1108
	AUDIT_USER_ERR                 AuditMessageType = 1109
	AUDIT_CRED_REFR                AuditMessageType = 1110
	AUDIT_USYS_CONFIG              AuditMessageType = 1111
	AUDIT_USER_LOGIN               AuditMessageType = 1112
	AUDIT_USER_LOGOUT              AuditMessageType = 1113
	AUDIT_ADD_USER                 AuditMessageType = 1114
	AUDIT_DEL_USER                 AuditMessageType = 1115
	AUDIT_ADD_GROUP                AuditMessageType = 1116
	AUDIT_DEL_GROUP                AuditMessageType = 1117
	AUDIT_DAC_CHECK                AuditMessageType = 1118
	AUDIT_CHGRP_ID                 AuditMessageType = 1119
	AUDIT_TEST                     AuditMessageType = 1120
	AUDIT_TRUSTED_APP              AuditMessageType = 1121
	AUDIT_USER_SELINUX_ERR         AuditMessageType = 1122
	AUDIT_USER_CMD                 AuditMessageType = 1123
	AUDIT_USER_TTY                 AuditMessageType = 1124
	AUDIT_CHUSER_ID                AuditMessageType = 1125
	AUDIT_GRP_AUTH                 AuditMessageType = 1126
	AUDIT_SYSTEM_BOOT              AuditMessageType = 1127
	AUDIT_SYSTEM_SHUTDOWN          AuditMessageType = 1128
	AUDIT_SYSTEM_RUNLEVEL          AuditMessageType = 1129
	AUDIT_SERVICE_START            AuditMessageType = 1130
	AUDIT_SERVICE_STOP             AuditMessageType = 1131
	AUDIT_GRP_MGMT                 AuditMessageType = 1132
	AUDIT_GRP_CHAUTHTOK            AuditMessageType = 1133
	AUDIT_MAC_CHECK                AuditMessageType = 1134
	AUDIT_ACCT_LOCK                AuditMessageType = 1135
	AUDIT_ACCT_UNLOCK              AuditMessageType = 1136
	AUDIT_USER_DEVICE              AuditMessageType = 1137
	AUDIT_SOFTWARE_UPDATE          AuditMessageType = 1138
	AUDIT_LAST_USER_MSG            AuditMessageType = 1199
	AUDIT_DAEMON_START             AuditMessageType = 1200
	AUDIT_DAEMON_END               AuditMessageType = 1201
	AUDIT_DAEMON_ABORT             AuditMessageType = 1202
	AUDIT_DAEMON_CONFIG            AuditMessageType = 1203
	AUDIT_DAEMON_RECONFIG          AuditMessageType = 1204
	AUDIT_DAEMON_ROTATE            AuditMessageType = 1205
	AUDIT_DAEMON_RESUME            AuditMessageType = 1206
	AUDIT_DAEMON_ACCEPT            AuditMessageType = 1207
	AUDIT_DAEMON_CLOSE             AuditMessageType = 1208
	AUDIT_DAEMON_ERR               AuditMessageType = 1209
	AUDIT_LAST_DAEMON              AuditMessageType = 1299
	AUDIT_SYSCALL                  AuditMessageType = 1300
	AUDIT_PATH                     AuditMessageType = 1302
	AUDIT_IPC                      AuditMessageType = 1303
	AUDIT_SOCKETCALL               AuditMessageType = 1304
	AUDIT_CONFIG_CHANGE            AuditMessageType = 1305
	AUDIT_SOCKADDR                 AuditMessageType = 1306
	AUDIT_CWD                      AuditMessageType = 1307
	AUDIT_EXECVE                   AuditMessageType = 1309
	AUDIT_IPC_SET_PERM             AuditMessageType = 1311
	AUDIT_MQ_OPEN                  AuditMessageType = 1312
	AUDIT_MQ_SENDRECV              AuditMessageType = 1313
	AUDIT_MQ_NOTIFY                AuditMessageType = 1314
	AUDIT_MQ_GETSETATTR            AuditMessageType = 1315
	AUDIT_KERNEL_OTHER             AuditMessageType = 1316
	AUDIT_FD_PAIR                  AuditMessageType = 1317
	AUDIT_OBJ_PID                  AuditMessageType = 1318
	AUDIT_TTY                      AuditMessageType = 1319
	AUDIT_EOE                      AuditMessageType = 1320
	AUDIT_BPRM_FCAPS               AuditMessageType = 1321
	AUDIT_CAPSET                   AuditMessageType = 1322
	AUDIT_MMAP                     AuditMessageType = 1323
	AUDIT_NETFILTER_PKT            AuditMessageType = 1324
	AUDIT_NETFILTER_CFG            AuditMessageType = 1325
	AUDIT_SECCOMP                  AuditMessageType = 1326
	AUDIT_PROCTITLE                AuditMessageType = 1327
	AUDIT_FEATURE_CHANGE           AuditMessageType = 1328
	AUDIT_REPLACE                  AuditMessageType = 1329
	AUDIT_KERN_MODULE              AuditMessageType = 1330
	AUDIT_FANOTIFY                 AuditMessageType = 1331
	AUDIT_LAST_EVENT               AuditMessageType = 1399
	AUDIT_AVC                      AuditMessageType = 1400
	AUDIT_SELINUX_ERR              AuditMessageType = 1401
	AUDIT_AVC_PATH                 AuditMessageType = 1402
	AUDIT_MAC_POLICY_LOAD          AuditMessageType = 1403
	AUDIT_MAC_STATUS               AuditMessageType = 1404
	AUDIT_MAC_CONFIG_CHANGE        AuditMessageType = 1405
	AUDIT_MAC_UNLBL_ALLOW          AuditMessageType = 1406
	AUDIT_MAC_CIPSOV4_ADD          AuditMessageType = 1407
	AUDIT_MAC_CIPSOV4_DEL          AuditMessageType = 1408
	AUDIT_MAC_MAP_ADD              AuditMessageType = 1409
	AUDIT_MAC_MAP_DEL              AuditMessageType = 1410
	AUDIT_MAC_IPSEC_ADDSA          AuditMessageType = 1411
	AUDIT_MAC_IPSEC_DELSA          AuditMessageType = 1412
	AUDIT_MAC_IPSEC_ADDSPD         AuditMessageType = 1413
	AUDIT_MAC_IPSEC_DELSPD         AuditMessageType = 1414
	AUDIT_MAC_IPSEC_EVENT          AuditMessageType = 1415
	AUDIT_MAC_UNLBL_STCADD         AuditMessageType = 1416
	AUDIT_MAC_UNLBL_STCDEL         AuditMessageType = 1417
	AUDIT_MAC_CALIPSO_ADD          AuditMessageType = 1418
	AUDIT_MAC_CALIPSO_DEL          AuditMessageType = 1419
	AUDIT_LAST_SELINUX             AuditMessageType = 1499
	AUDIT_AA                       AuditMessageType = 1500
	AUDIT_APPARMOR_AUDIT           AuditMessageType = 1501
	AUDIT_APPARMOR_ALLOWED         AuditMessageType = 1502
	AUDIT_APPARMOR_DENIED          AuditMessageType = 1503
	AUDIT_APPARMOR_HINT            AuditMessageType = 1504
	AUDIT_APPARMOR_STATUS          AuditMessageType = 1505
	AUDIT_APPARMOR_ERROR           AuditMessageType = 1506
	AUDIT_LAST_APPARMOR            AuditMessageType = 1599
	AUDIT_FIRST_KERN_CRYPTO_MSG    AuditMessageType = 1600
	AUDIT_LAST_KERN_CRYPTO_MSG     AuditMessageType = 1699
	AUDIT_ANOM_PROMISCUOUS         AuditMessageType = 1700
	AUDIT_ANOM_ABEND               AuditMessageType = 1701
	AUDIT_ANOM_LINK                AuditMessageType = 1702
	AUDIT_LAST_KERN_ANOM_MSG       AuditMessageType = 1799
	AUDIT_INTEGRITY_DATA           AuditMessageType = 1800
	AUDIT_INTEGRITY_METADATA       AuditMessageType = 1801
	AUDIT_INTEGRITY_STATUS         AuditMessageType = 1802
	AUDIT_INTEGRITY_HASH           AuditMessageType = 1803
	AUDIT_INTEGRITY_PCR            AuditMessageType = 1804
	AUDIT_INTEGRITY_RULE           AuditMessageType = 1805
	AUDIT_INTEGRITY_LAST_MSG       AuditMessageType = 1899
	AUDIT_KERNEL                   AuditMessageType = 2000
	AUDIT_ANOM_LOGIN_FAILURES      AuditMessageType = 2100
	AUDIT_ANOM_LOGIN_TIME          AuditMessageType = 2101
	AUDIT_ANOM_LOGIN_SESSIONS      AuditMessageType = 2102
	AUDIT_ANOM_LOGIN_ACCT          AuditMessageType = 2103
	AUDIT_ANOM_LOGIN_LOCATION      AuditMessageType = 2104
	AUDIT_ANOM_MAX_DAC             AuditMessageType = 2105
	AUDIT_ANOM_MAX_MAC             AuditMessageType = 2106
	AUDIT_ANOM_AMTU_FAIL           AuditMessageType = 2107
	AUDIT_ANOM_RBAC_FAIL           AuditMessageType = 2108
	AUDIT_ANOM_RBAC_INTEGRITY_FAIL AuditMessageType = 2109
	AUDIT_ANOM_CRYPTO_FAIL         AuditMessageType = 2110
	AUDIT_ANOM_ACCESS_FS           AuditMessageType = 2111
	AUDIT_ANOM_EXEC                AuditMessageType = 2112
	AUDIT_ANOM_MK_EXEC             AuditMessageType = 2113
	AUDIT_ANOM_ADD_ACCT            AuditMessageType = 2114
	AUDIT_ANOM_DEL_ACCT            AuditMessageType = 2115
	AUDIT_ANOM_MOD_ACCT            AuditMessageType = 2116
	AUDIT_ANOM_ROOT_TRANS          AuditMessageType = 2117
	AUDIT_ANOM_LOGIN_SERVICE       AuditMessageType = 2118
	AUDIT_LAST_ANOM_MSG            AuditMessageType = 2199
	AUDIT_RESP_ANOMALY             AuditMessageType = 2200
	AUDIT_RESP_ALERT               AuditMessageType = 2201
	AUDIT_RESP_KILL_PROC           AuditMessageType = 2202
	AUDIT_RESP_TERM_ACCESS         AuditMessageType = 2203
	AUDIT_RESP_ACCT_REMOTE         AuditMessageType = 2204
	AUDIT_RESP_ACCT_LOCK_TIMED     AuditMessageType = 2205
	AUDIT_RESP_ACCT_UNLOCK_TIMED   AuditMessageType = 2206
	AUDIT_RESP_ACCT_LOCK           AuditMessageType = 2207
	AUDIT_RESP_TERM_LOCK           AuditMessageType = 2208
	AUDIT_RESP_SEBOOL              AuditMessageType = 2209
	AUDIT_RESP_EXEC                AuditMessageType = 2210
	AUDIT_RESP_SINGLE              AuditMessageType = 2211
	AUDIT_RESP_HALT                AuditMessageType = 2212
	AUDIT_RESP_ORIGIN_BLOCK        AuditMessageType = 2213
	AUDIT_RESP_ORIGIN_BLOCK_TIMED  AuditMessageType = 2214
	AUDIT_LAST_ANOM_RESP           AuditMessageType = 2299
	AUDIT_USER_ROLE_CHANGE         AuditMessageType = 2300
	AUDIT_ROLE_ASSIGN              AuditMessageType = 2301
	AUDIT_ROLE_REMOVE              AuditMessageType = 2302
	AUDIT_LABEL_OVERRIDE           AuditMessageType = 2303
	AUDIT_LABEL_LEVEL_CHANGE       AuditMessageType = 2304
	AUDIT_USER_LABELED_EXPORT      AuditMessageType = 2305
	AUDIT_USER_UNLABELED_EXPORT    AuditMessageType = 2306
	AUDIT_DEV_ALLOC                AuditMessageType = 2307
	AUDIT_DEV_DEALLOC              AuditMessageType = 2308
	AUDIT_FS_RELABEL               AuditMessageType = 2309
	AUDIT_USER_MAC_POLICY_LOAD     AuditMessageType = 2310
	AUDIT_ROLE_MODIFY              AuditMessageType = 2311
	AUDIT_USER_MAC_CONFIG_CHANGE   AuditMessageType = 2312
	AUDIT_LAST_USER_LSPP_MSG       AuditMessageType = 2399
	AUDIT_CRYPTO_TEST_USER         AuditMessageType = 2400
	AUDIT_CRYPTO_PARAM_CHANGE_USER AuditMessageType = 2401
	AUDIT_CRYPTO_LOGIN             AuditMessageType = 2402
	AUDIT_CRYPTO_LOGOUT            AuditMessageType = 2403
	AUDIT_CRYPTO_KEY_USER          AuditMessageType = 2404
	AUDIT_CRYPTO_FAILURE_USER      AuditMessageType = 2405
	AUDIT_CRYPTO_REPLAY_USER       AuditMessageType = 2406
	AUDIT_CRYPTO_SESSION           AuditMessageType = 2407
	AUDIT_CRYPTO_IKE_SA            AuditMessageType = 2408
	AUDIT_CRYPTO_IPSEC_SA          AuditMessageType = 2409
	AUDIT_LAST_CRYPTO_MSG          AuditMessageType = 2499
	AUDIT_VIRT_CONTROL             AuditMessageType = 2500
	AUDIT_VIRT_RESOURCE            AuditMessageType = 2501
	AUDIT_VIRT_MACHINE_ID          AuditMessageType = 2502
	AUDIT_VIRT_INTEGRITY_CHECK     AuditMessageType = 2503
	AUDIT_VIRT_CREATE              AuditMessageType = 2504
	AUDIT_VIRT_DESTROY             AuditMessageType = 2505
	AUDIT_VIRT_MIGRATE_IN          AuditMessageType = 2506
	AUDIT_VIRT_MIGRATE_OUT         AuditMessageType = 2507
	AUDIT_LAST_VIRT_MSG            AuditMessageType = 2599
	AUDIT_LAST_USER_MSG2           AuditMessageType = 2999
)

List of AuditMessageTypes.

func GetAuditMessageType

func GetAuditMessageType(name string) (AuditMessageType, error)

GetAuditMessageType accepts a type name and returns its numerical representation. If the name is unknown and error is returned.

func (AuditMessageType) MarshalText added in v0.0.3

func (t AuditMessageType) MarshalText() (text []byte, err error)

func (AuditMessageType) String

func (t AuditMessageType) String() string

func (*AuditMessageType) UnmarshalText added in v0.0.7

func (t *AuditMessageType) UnmarshalText(text []byte) error

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL