PERFORCE change 150972 for review

[Robert Watson]

http://perforce.freebsd.org/chv.cgi?CH=150972

Change 150972 by rwatson at rwatson_cinnamon on 2008/10/04 15:19:48

	Remove commented out expanded ip token -- there isn't one.
	Expand description of socket_ex token.
	Describe zonename token.

Affected files ...

.. //depot/projects/trustedbsd/openbsm/man/audit.log.5#19 edit

Differences ...

==== //depot/projects/trustedbsd/openbsm/man/audit.log.5#19 (text+ko) ====

@@ -23,7 +23,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit.log.5#18 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/man/audit.log.5#19 $
 .\"
 .Dd November 5, 2006
 .Dt AUDIT.LOG 5
@@ -229,15 +229,6 @@
 .It "Source Address	4 bytes	IPv4 source address"
 .It "Destination Address	4 bytes	IPv4 destination address"
 .El
-.\" .Ss Expanded ip Token
-.\" The
-.\" .Dq expanded ip
-.\" token ...
-.\" .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
-.\" .It Sy "Field	Bytes	Description"
-.\" .It "Token ID	1 byte	Token ID"
-.\" .It XXXX
-.\" .El
 .Ss iport Token
 The
 .Dq iport
@@ -583,7 +574,7 @@
 .Ss Expanded Socket Token
 The
 .Dq expanded socket
-token ...
+token contains information about IPv4 and IPv6 sockets.
 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
 .It Sy "Field	Bytes	Description"
 .It "Token ID	1 byte	Token ID"
@@ -639,11 +630,18 @@
 .Ss Zonename Token
 The
 .Dq zonename
-token ...
+token holds a NUL-terminated string with the name of the zone or jail from
+which the record originated.
+A
+.Dz zonename
+token can be created using
+.Xr au_to_zonename 3 .
+.Pp
 .Bl -column -offset 3n ".No Terminal Address Type/Length" ".No N bytes + 1 NUL"
 .It Sy "Field	Bytes	Description"
 .It "Token ID	1 byte	Token ID"
-.It XXXXX
+.It "Zonename length	2 bytes	Length of zonename string including NUL"
+.It "Zonename	N bytes + 1 NUL	Zonename string including NUL"
 .El
 .Sh SEE ALSO
 .Xr auditreduce 1 ,