There seems to be an issue with the audit.log(5) manpage, under the section "Expanded Header Token". It says: A 32-bit extended "header" token can be created using au_to_header32_ex(3); a 64-bit extended "header" token can be created using au_to_header64_ex(3). - There are no man pages associated with the au_to_header32_ex and au_to_header64_ex. - I was able to find the function au_to_header32_ex in the FreeBSD source. But there was no au_to_header64_ex in the source code.
Looks like au_to_header32_ex.3 is supposed to be symlinked to au_token.3, see contrib/openbsm/libbsm/Makefile.am and contrib/openbsm/libbsm/Makefile.in, but this link is missing from MLINKS in 12.1's lib/libbsm/Makefile although present in -current's. The spurious reference to au_to_header64_ex(3) in contrib/openbsm/man/audit.log.5 (present in both 12.1 and -current) should probably be fixed upstream.
Created attachment 228771 [details] audit.log(5) patch Change reference from au_to_header64_ex to au_to_header64. There is no function au_to_header64_ex.
(In reply to Felix Johnson from comment #2) Is the item missing from MLINKS in 12.1 (see my earlier comment) present in 12-stable for the upcoming 12.3? If not, adding it posthate (perhaps in another bug) would be good, I think.
I don't have access to a 12.2 system, but the pages show up online: au_to_header32_ex: https://www.freebsd.org/cgi/man.cgi?query=au_to_header32_ex&apropos=0&sektion=0&manpath=FreeBSD+12.2-RELEASE&arch=default&format=html au_to_header64: https://www.freebsd.org/cgi/man.cgi?query=au_to_header64&apropos=0&sektion=0&manpath=FreeBSD+12.2-RELEASE&arch=default&format=html I couldn't find MLINKS in any of the contrib/openbsm Makefiles.
(In reply to Felix Johnson from comment #4) MLINKS is defined in /usr/src/lib/libbsm/Makefile. Also, I just checked on my 12.2 and it looks like it was MFC'd between 12.1 and 12.2. So that part is moot as well.