AUE_mount

Montage d’un lecteur

Le journal de montage d’un lecteur est généré lorsqu’un processus demande le montage d’un lecteur physique ou virtuel. Il peut s’agir de systèmes de fichiers réseau, de lecteurs externes ou d’autres types de systèmes de fichiers.

Log Level (Niveau du journal)

1

Requiert l’option Verbose (Détaillé)

Non

AUE_mount Example

Exemple de journal de télémétrie pour le montage d’un lecteur.

{
  "arguments": {
    "flags": 136315929
  },
  "attributes": {
    "device": 0,
    "owner_group_name": "wheel",
    "owner_user_id": 501,
    "owner_user_name": "test",
    "file_system_id": 16777224,
    "file_access_mode": 16457,
    "node_id": 1203817,
    "owner_group_id": 0
  },
  "exec_chain": {
    "uuid": "CA95BCEC-3E74-40F5-B822-78F58BFD0181"
  },
  "exec_chain_child": {
    "parent_path": "/sbin/mount",
    "parent_pid": 1852,
    "parent_uuid": "89C1FD71-B91D-411C-AD30-0AB60D64B951"
  },
  "header": {
    "time_seconds_epoch": 1657906405,
    "time_milliseconds_offset": 546,
    "version": 11,
    "event_modifier": 0,
    "event_id": 62,
    "event_name": "AUE_MOUNT"
  },
  "host_info": {
    "serial_number": "C03WG0H4HDTS",
    "host_name": "Test_MacBook_Pro",
    "osversion": "Version 12.4 (Build 21F79)",
    "host_uuid": "8891C1E2-0AC0-4E4A-844B-EA491B14D115"
  },
  "identity": {
    "signer_id": "com.apple.mount_hfs",
    "team_id_truncated": false,
    "signer_id_truncated": false,
    "cd_hash": "c4d5432721b0a0eb1b16a67c1bab40440b8a7b76",
    "team_id": "",
    "signer_type": 1
  },
  "key": "F36BF77C-0ECB-4A78-A3D4-9D662ABE123F",
  "path": [
    "/Volumes/Google Chrome",
    "/Volumes/Google Chrome"
  ],
  "return": {
    "error": 0,
    "description": "success",
    "return_value": 0
  },
  "subject": {
    "session_id": 100000,
    "group_id": 20,
    "process_name": "/System/Library/Filesystems/hfs.fs/Contents/Resources/mount_hfs",
    "parent_pid": 1852,
    "effective_user_name": "jamf",
    "user_id": 501,
    "group_name": "staff",
    "parent_uuid": "89C1FD71-B91D-411C-AD30-0AB60D64B951",
    "uuid": "CA95BCEC-3E74-40F5-B822-78F58BFD0181",
    "effective_group_id": 20,
    "process_hash": "5093a3e15b4f7267d0c12d0286d884aef2b75f53",
    "audit_id": 4294967295,
    "responsible_process_id": 104,
    "parent_path": "/sbin/mount",
    "process_id": 1853,
    "effective_group_name": "staff",
    "audit_user_name": "",
    "effective_user_id": 501,
    "terminal_id": {
      "type": 4,
      "ip_address": "0.0.0.0",
      "port": 0
    },
    "responsible_process_name": "/usr/libexec/diskarbitrationd",
    "user_name": "jamf"
  },
  "texts": [
    "hfs"
  ]
}