return Token
The return token contains the return status of the system call (u_error) and the process return value (u_rval1). This token has three fields:
A token ID that identifies this token as a return token
The error status of the system call
The return value of the system call
The return token is always returned as part of kernel-generated audit records for system calls. This token indicates exit status and other return values in application auditing.
The praudit command displays the return token as follows:
return,success,0
The following figures shows the format of a return token.
Figure 23–23 return Token Format
