AUE_GETAUID

Get AUID (Obtention de l’AUID)

Le journal d’obtention de l’AUID est généré lorsqu’un appel système est utilisé pour déterminer l’identifiant du véritable utilisateur d’un processus. Cette information est utilisée pour déterminer la ressource à laquelle le processus est autorisé à accéder.

Log Level (Niveau du journal)

1

Requiert l’option Verbose (Détaillé)

Non

AUE_GETAUID Example

Exemple de journal de télémétrie pour l’obtention de l’AUID.

{
  "exec_chain": {
    "uuid": "D45A43D9-E6F9-4641-918E-08F3F204649B"
  },
  "exec_chain_child": {
    "parent_path": "/sbin/launchd",
    "parent_pid": 1,
    "parent_uuid": "4AB281FE-6D4A-4E79-8508-E91FCA39BA02"
  },
  "header": {
    "time_seconds_epoch": 1657906962,
    "time_milliseconds_offset": 376,
    "version": 11,
    "event_modifier": 0,
    "event_id": 130,
    "event_name": "AUE_GETAUID"
  },
  "host_info": {
    "serial_number": "C03WG0H4HDTS",
    "host_name": "Test_MacBook_Pro",
    "osversion": "Version 12.4 (Build 21F79)",
    "host_uuid": "8891C1E2-0AC0-4E4A-844B-EA491B14D115"
  },
  "identity": {
    "signer_id": "com.apple.loginwindow",
    "team_id_truncated": false,
    "signer_id_truncated": false,
    "cd_hash": "c1e628cea8d99f35c367658373c85c5fa6da086f",
    "team_id": "",
    "signer_type": 1
  },
  "key": "4DBDAA85-56F8-4723-A832-620067DB9BF2",
  "return": {
    "error": 0,
    "description": "success",
    "return_value": 0
  },
  "subject": {
    "session_id": 100003,
    "group_id": 20,
    "process_name": "/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow",
    "parent_pid": 1,
    "effective_user_name": "jamf",
    "user_id": 0,
    "group_name": "staff",
    "parent_uuid": "4AB281FE-6D4A-4E79-8508-E91FCA39BA02",
    "uuid": "D45A43D9-E6F9-4641-918E-08F3F204649B",
    "effective_group_id": 20,
    "process_hash": "4b2779fead757431ec1e2c60f479c8a86ad744fe",
    "audit_id": 501,
    "responsible_process_id": 148,
    "parent_path": "/sbin/launchd",
    "process_id": 148,
    "effective_group_name": "staff",
    "audit_user_name": "jamf",
    "effective_user_id": 501,
    "terminal_id": {
      "type": 4,
      "ip_address": "0.0.0.0",
      "port": 50331650
    },
    "responsible_process_name": "/System/Library/CoreServices/loginwindow.app/Contents/MacOS/loginwindow",
    "user_name": "root"
  }
}