#include <mach/audit_triggers_server.h>

mach/audit_triggers_server.h Kernel.framework

includes: Kernel/string.h, Kernel/mach/ndr.h, Kernel/mach/boolean.h, Kernel/mach/kern_return.h, Kernel/mach/notify.h, mach/mach_types.h, mach/message.h, Kernel/mach/mig_errors.h, mach/port.h, Availability.h, Kernel/mach/std_types.h, Kernel/mach/mig.h, Kernel/mach/mig.h, mach/mach_types.h, Kernel/mach/audit_triggers_types.h

4 functions · 3 macros · 1 struct · 1 variable

macro_audit_triggers_server_

#define _audit_triggers_server_

macroaudit_triggers_MSG_COUNT

#define audit_triggers_MSG_COUNT 2

functionaudit_triggers

extern MIG_SERVER_ROUTINE kern_return_t audit_triggers(
	mach_port_t audit_port,
	int flags
)

MIG routine from mach/audit_triggers.defs · simpleroutine

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu osfmk/mach/audit_triggers.defs, bsd/security/audit/audit_bsd.c, bsd/bsm/audit.h

Server-interface routine of the audit_triggers MIG subsystem (subsystem id 123), implemented by the audit daemon (auditd). The kernel sends this one-way message on the host audit control port from audit_send_trigger (bsd/security/audit/audit_bsd.c) to request daemon action; flags carries one AUDIT_TRIGGER_* event code: AUDIT_TRIGGER_LOW_SPACE below low watermark AUDIT_TRIGGER_ROTATE_KERNEL kernel requests log rotation AUDIT_TRIGGER_READ_FILE re-read configuration file AUDIT_TRIGGER_CLOSE_AND_DIE terminate auditing AUDIT_TRIGGER_NO_SPACE below minimum free space

functionaudit_analytics

extern MIG_SERVER_ROUTINE kern_return_t audit_analytics(
	mach_port_t audit_port,
	string_t caller_id,
	string_t caller_name
)

MIG routine from mach/audit_triggers.defs · simpleroutine

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu osfmk/mach/audit_triggers.defs, bsd/security/audit/audit_bsd.c

Server-interface routine of the audit_triggers MIG subsystem, implemented by the audit daemon. The kernel sends this one-way message on the host audit control port from audit_send_analytics (bsd/security/audit/audit_bsd.c), reporting the code-signing identifier (caller_id) and process name (caller_name) of a caller for analytics purposes. Both strings are bounded C strings of at most 1024 bytes.

functionaudit_triggers_server

extern boolean_t audit_triggers_server(
	mach_msg_header_t *InHeadP,
	mach_msg_header_t *OutHeadP
)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu osfmk/mach/audit_triggers.defs

MIG-generated demultiplexer for the audit_triggers subsystem (osfmk/mach/audit_triggers.defs). If the request message at InHeadP belongs to the subsystem, calls the matching handler (audit_triggers, audit_analytics), formats the reply message at OutHeadP, and returns TRUE; returns FALSE, with a MIG_BAD_ID error reply, for messages that do not belong to the subsystem.

functionaudit_triggers_server_routine

extern mig_routine_t audit_triggers_server_routine(mach_msg_header_t *InHeadP)

▾

claude-fable-5, 2026-08-24 · not from Apple sources · verified against xnu osfmk/mach/audit_triggers.defs

Returns the MIG dispatch function for the audit_triggers subsystem request whose msgh_id is found in InHeadP, or a null pointer if the message is not a request of the subsystem. Alternative to the combined demultiplexer for servers that look up and invoke the handler themselves.

structaudit_triggers_subsystem

Description of this subsystem, for use in direct RPC

size 112, align 8

mig_server_routine_t	server	Server routine
mach_msg_id_t	start	Min routine number
mach_msg_id_t	end	Max routine number + 1
unsigned int	maxsize	Max msg size
vm_address_t	reserved	Reserved
struct routine_descriptor[2]	routine

variableaudit_triggers_subsystem

extern const struct audit_triggers_subsystem { mig_server_routine_t server; /* Server routine */ mach_msg_id_t start; /* Min routine number */ mach_msg_id_t end; /* Max routine number + 1 */ unsigned int maxsize; /* Max msg size */ vm_address_t reserved; /* Reserved */ struct routine_descriptor /* Array of routine descriptors */ routine[2]; } audit_triggers_subsystem

macrosubsystem_to_name_map_audit_triggers

#define subsystem_to_name_map_audit_triggers { "audit_triggers", 123 },
    { "audit_analytics", 124 }