some tests was added.
authori.metelytsia <i.metelytsia@samsung.com>
Wed, 22 Nov 2017 14:39:59 +0000 (16:39 +0200)
committeri.metelytsia <i.metelytsia@samsung.com>
Thu, 23 Nov 2017 11:04:01 +0000 (13:04 +0200)
device_core/mock/audit-trail-stub.cpp
device_core/mock/audit-trail-stub.h
device_core/utest/test_audit_trail_client.cpp

index b93c4dc..bf38f56 100644 (file)
@@ -66,47 +66,47 @@ int audit_trail_is_enabled_dac(audit_trail_h handle, bool *en)
 
 int audit_trail_get_dac_time(audit_trail_dac_h handle, time_t *tm, unsigned short *ms)
 {
-    return IAuditTrail::audit_trail_get_dac_time(tm, ms);
+    return p_atrail->audit_trail_get_dac_time(tm, ms);
 }
 
 int audit_trail_get_dac_subject_name(audit_trail_dac_h handle, const char **name)
 {
-    return IAuditTrail::audit_trail_get_dac_subject_name(name);
+    return p_atrail->audit_trail_get_dac_subject_name(name);
 }
 
 int audit_trail_get_dac_subject_owner(audit_trail_dac_h handle, uid_t *uid, gid_t *gid)
 {
-    return IAuditTrail::audit_trail_get_dac_subject_owner(uid, gid);
+    return p_atrail->audit_trail_get_dac_subject_owner(uid, gid);
 }
 
 int audit_trail_get_dac_subject_effective_owner(audit_trail_dac_h handle, uid_t *euid, gid_t *egid)
 {
-    return IAuditTrail::audit_trail_get_dac_subject_effective_owner(euid, egid);
+    return p_atrail->audit_trail_get_dac_subject_effective_owner(euid, egid);
 }
 
 int audit_trail_get_dac_subject_pid(audit_trail_dac_h handle, pid_t *pid)
 {
-    return IAuditTrail::audit_trail_get_dac_subject_pid(pid);
+    return p_atrail->audit_trail_get_dac_subject_pid(pid);
 }
 
 int audit_trail_get_dac_object_name(audit_trail_dac_h handle, const char **name)
 {
-    return IAuditTrail::audit_trail_get_dac_object_name(name);
+    return p_atrail->audit_trail_get_dac_object_name(name);
 }
 
 int audit_trail_get_dac_object_owner(audit_trail_dac_h handle, uid_t *uid, gid_t *gid)
 {
-    return IAuditTrail::audit_trail_get_dac_object_owner(uid, gid);
+    return p_atrail->audit_trail_get_dac_object_owner(uid, gid);
 }
 
 int audit_trail_get_dac_object_mode(audit_trail_dac_h handle, mode_t *mode)
 {
-    return IAuditTrail::audit_trail_get_dac_object_mode(mode);
+    return p_atrail->audit_trail_get_dac_object_mode(mode);
 }
 
 int audit_trail_get_dac_action_syscall(audit_trail_dac_h handle, unsigned int *syscall)
 {
-    return IAuditTrail::audit_trail_get_dac_action_syscall(syscall);
+    return p_atrail->audit_trail_get_dac_action_syscall(syscall);
 }
 
 
@@ -148,42 +148,42 @@ int audit_trail_is_enabled_mac(audit_trail_h handle, bool *en)
 
 int audit_trail_get_mac_time(audit_trail_mac_h handle, time_t *tm, unsigned short *ms)
 {
-    return IAuditTrail::audit_trail_get_mac_time(tm, ms);
+    return p_atrail->audit_trail_get_mac_time(tm, ms);
 }
 
 int audit_trail_get_mac_subject_name(audit_trail_mac_h handle, const char **name)
 {
-    return IAuditTrail::audit_trail_get_mac_subject_name(name);
+    return p_atrail->audit_trail_get_mac_subject_name(name);
 }
 
 int audit_trail_get_mac_subject_label(audit_trail_mac_h handle, const char **label)
 {
-    return IAuditTrail::audit_trail_get_mac_subject_label(label);
+    return p_atrail->audit_trail_get_mac_subject_label(label);
 }
 
 int audit_trail_get_mac_subject_pid(audit_trail_mac_h handle, pid_t *pid)
 {
-    return IAuditTrail::audit_trail_get_mac_subject_pid(pid);
+    return p_atrail->audit_trail_get_mac_subject_pid(pid);
 }
 
 int audit_trail_get_mac_object_name(audit_trail_mac_h handle, const char **name)
 {
-    return IAuditTrail::audit_trail_get_mac_object_name(name);
+    return p_atrail->audit_trail_get_mac_object_name(name);
 }
 
 int audit_trail_get_mac_object_label(audit_trail_mac_h handle, const char **label)
 {
-    return IAuditTrail::audit_trail_get_mac_object_label(label);
+    return p_atrail->audit_trail_get_mac_object_label(label);
 }
 
 int audit_trail_get_mac_action_syscall(audit_trail_mac_h handle, unsigned int *syscall)
 {
-    return IAuditTrail::audit_trail_get_mac_action_syscall(syscall);
+    return p_atrail->audit_trail_get_mac_action_syscall(syscall);
 }
 
 int audit_trail_get_mac_action_request(audit_trail_mac_h handle, const char **req)
 {
-    return IAuditTrail::audit_trail_get_mac_action_request(req);
+    return p_atrail->audit_trail_get_mac_action_request(req);
 }
 
 
@@ -225,37 +225,37 @@ int audit_trail_is_enabled_syscall(audit_trail_h handle, bool *en)
 
 int audit_trail_get_syscall_time(audit_trail_syscall_h handle, time_t *tm, unsigned short *ms)
 {
-    return IAuditTrail::audit_trail_get_syscall_time(tm, ms);
+    return p_atrail->audit_trail_get_syscall_time(tm, ms);
 }
 
 int audit_trail_get_syscall_subject_name(audit_trail_syscall_h handle, const char **name)
 {
-    return IAuditTrail::audit_trail_get_syscall_subject_name(name);
+    return p_atrail->audit_trail_get_syscall_subject_name(name);
 }
 
 int audit_trail_get_syscall_subject_owner(audit_trail_syscall_h handle, uid_t *uid, gid_t *gid)
 {
-    return IAuditTrail::audit_trail_get_syscall_subject_owner(uid, gid);
+    return p_atrail->audit_trail_get_syscall_subject_owner(uid, gid);
 }
 
 int audit_trail_get_syscall_subject_effective_owner(audit_trail_syscall_h handle, uid_t *euid, gid_t *egid)
 {
-    return IAuditTrail::audit_trail_get_syscall_subject_effective_owner(euid, egid);
+    return p_atrail->audit_trail_get_syscall_subject_effective_owner(euid, egid);
 }
 
 int audit_trail_get_syscall_subject_pid(audit_trail_syscall_h handle, pid_t *pid)
 {
-    return IAuditTrail::audit_trail_get_syscall_subject_pid(pid);
+    return p_atrail->audit_trail_get_syscall_subject_pid(pid);
 }
 
 int audit_trail_get_syscall_action_syscall(audit_trail_syscall_h handle, unsigned int *syscall)
 {
-    return IAuditTrail::audit_trail_get_syscall_action_syscall(syscall);
+    return p_atrail->audit_trail_get_syscall_action_syscall(syscall);
 }
 
 int audit_trail_get_syscall_action_exitcode(audit_trail_syscall_h handle, unsigned int *exit)
 {
-    return IAuditTrail::audit_trail_get_syscall_action_exitcode(exit);
+    return p_atrail->audit_trail_get_syscall_action_exitcode(exit);
 }
 
 
@@ -297,15 +297,15 @@ int audit_trail_is_enabled_user(audit_trail_h handle, bool *en)
 
 int audit_trail_get_user_time(audit_trail_user_h handle, time_t *tm, unsigned short *ms)
 {
-    return IAuditTrail::audit_trail_get_user_time(tm, ms);
+    return p_atrail->audit_trail_get_user_time(tm, ms);
 }
 
 int audit_trail_get_user_log_type(audit_trail_user_h handle, int *type)
 {
-    return IAuditTrail::audit_trail_get_user_log_type(type);
+    return p_atrail->audit_trail_get_user_log_type(type);
 }
 
 int audit_trail_get_user_log_text(audit_trail_user_h handle, const char **text)
 {
-    return IAuditTrail::audit_trail_get_user_log_text(text);
+    return p_atrail->audit_trail_get_user_log_text(text);
 }
index e262254..b22d6a1 100644 (file)
@@ -22,254 +22,266 @@ public:
     virtual int audit_trail_remove_dac_cb(int id) = 0;
     virtual int audit_trail_enable_dac(bool en) = 0;
     virtual int audit_trail_is_enabled_dac(bool *en) = 0;
-    static int audit_trail_get_dac_time(time_t *tm, unsigned short *ms)
+    virtual int audit_trail_get_dac_time(time_t *tm, unsigned short *ms) = 0;
+    virtual int audit_trail_get_dac_subject_name(const char **name) = 0;
+    virtual int audit_trail_get_dac_subject_owner(uid_t *uid, gid_t *gid) = 0;
+    virtual int audit_trail_get_dac_subject_effective_owner(uid_t *euid, gid_t *egid) = 0;
+    virtual int audit_trail_get_dac_subject_pid(pid_t *pid) = 0;
+    virtual int audit_trail_get_dac_object_name(const char **name) = 0;
+    virtual int audit_trail_get_dac_object_owner(uid_t *uid, gid_t *gid) = 0;
+    virtual int audit_trail_get_dac_object_mode(mode_t *mode) = 0;
+    virtual int audit_trail_get_dac_action_syscall(unsigned int *syscall) = 0;
+
+    virtual int audit_trail_foreach_mac(audit_trail_mac_cb callback, void *user_data) = 0;
+    virtual int audit_trail_clear_mac() = 0;
+    virtual int audit_trail_add_mac_cb(audit_trail_mac_cb callback, void* user_data, int* id) = 0;
+    virtual int audit_trail_remove_mac_cb(int id) = 0;
+    virtual int audit_trail_enable_mac(bool en) = 0;
+    virtual int audit_trail_is_enabled_mac(bool *en) = 0;
+    virtual int audit_trail_get_mac_time(time_t *tm, unsigned short *ms) = 0;
+    virtual int audit_trail_get_mac_subject_name(const char **name) = 0;
+    virtual int audit_trail_get_mac_subject_label(const char **label) = 0;
+    virtual int audit_trail_get_mac_subject_pid(pid_t *pid) = 0;
+    virtual int audit_trail_get_mac_object_name(const char **name) = 0;
+    virtual int audit_trail_get_mac_object_label(const char **label) = 0;
+    virtual int audit_trail_get_mac_action_syscall(unsigned int *syscall) = 0;
+    virtual int audit_trail_get_mac_action_request(const char **req) = 0;
+
+    virtual int audit_trail_foreach_syscall(audit_trail_syscall_cb callback, void *user_data) = 0;
+    virtual int audit_trail_clear_syscall() = 0;
+    virtual int audit_trail_add_syscall_cb(audit_trail_syscall_cb callback, void* user_data, int* id) = 0;
+    virtual int audit_trail_remove_syscall_cb(int id) = 0;
+    virtual int audit_trail_enable_syscall(bool en) = 0;
+    virtual int audit_trail_is_enabled_syscall(bool *en) = 0;
+    virtual int audit_trail_get_syscall_time(time_t *tm, unsigned short *ms) = 0;
+    virtual int audit_trail_get_syscall_subject_name(const char **name) = 0;
+    virtual int audit_trail_get_syscall_subject_owner(uid_t *uid, gid_t *gid) = 0;
+    virtual int audit_trail_get_syscall_subject_effective_owner(uid_t *euid, gid_t *egid) = 0;
+    virtual int audit_trail_get_syscall_subject_pid(pid_t *pid) = 0;
+    virtual int audit_trail_get_syscall_action_syscall(unsigned int *syscall) = 0;
+    virtual int audit_trail_get_syscall_action_exitcode(unsigned int *exit) = 0;
+
+    virtual int audit_trail_foreach_user(audit_trail_user_cb callback, void *user_data) = 0;
+    virtual int audit_trail_clear_user() = 0;
+    virtual int audit_trail_add_user_cb(audit_trail_user_cb callback, void* user_data, int* id) = 0;
+    virtual int audit_trail_remove_user_cb(int id) = 0;
+    virtual int audit_trail_enable_user(bool en) = 0;
+    virtual int audit_trail_is_enabled_user(bool *en) = 0;
+    virtual int audit_trail_get_user_time(time_t *tm, unsigned short *ms) = 0;
+    virtual int audit_trail_get_user_log_type(int *type) = 0;
+    virtual int audit_trail_get_user_log_text(const char **text) = 0;
+};
+
+void audit_trail_set_implementation(IAuditTrail* impl);
+
+class AuditTrailDefaultImpl: public IAuditTrail
+{
+public:
+    int audit_trail_create(audit_trail_h *handle) override
     {
-        time(tm); *ms = 0;
+        *handle = this;
         return 0;
     }
-    static int audit_trail_get_dac_subject_name(const char **name)
+    int audit_trail_destroy() override
     {
-        *name = "dac_subject_name";
         return 0;
     }
-    static int audit_trail_get_dac_subject_owner(uid_t *uid, gid_t *gid)
+
+    int audit_trail_foreach_dac(audit_trail_dac_cb callback, void *user_data) override
     {
-        *uid = getuid(); *gid = getgid();
         return 0;
     }
-    static int audit_trail_get_dac_subject_effective_owner(uid_t *euid, gid_t *egid)
+    int audit_trail_clear_dac() override
     {
-        *euid = geteuid(); *egid = getegid();
         return 0;
     }
-    static int audit_trail_get_dac_subject_pid(pid_t *pid)
+    int audit_trail_add_dac_cb(audit_trail_dac_cb callback, void* user_data, int* id) override
     {
-        *pid = getpid();
         return 0;
     }
-    static int audit_trail_get_dac_object_name(const char **name)
+    int audit_trail_remove_dac_cb(int id) override
     {
-        *name = "dac_object_name";
         return 0;
     }
-    static int audit_trail_get_dac_object_owner(uid_t *uid, gid_t *gid)
+    int audit_trail_enable_dac(bool en) override
     {
-        *uid = getuid(); *gid = getgid();
         return 0;
     }
-    static int audit_trail_get_dac_object_mode(mode_t *mode)
+    int audit_trail_is_enabled_dac(bool *en) override
     {
-        *mode = 0;
+        *en = true;
         return 0;
     }
-    static int audit_trail_get_dac_action_syscall(unsigned int *syscall)
+    int audit_trail_get_dac_time(time_t *tm, unsigned short *ms) override
     {
-        *syscall = 0;
+        time(tm); *ms = 0;
         return 0;
     }
-
-    virtual int audit_trail_foreach_mac(audit_trail_mac_cb callback, void *user_data) = 0;
-    virtual int audit_trail_clear_mac() = 0;
-    virtual int audit_trail_add_mac_cb(audit_trail_mac_cb callback, void* user_data, int* id) = 0;
-    virtual int audit_trail_remove_mac_cb(int id) = 0;
-    virtual int audit_trail_enable_mac(bool en) = 0;
-    virtual int audit_trail_is_enabled_mac(bool *en) = 0;
-    static int audit_trail_get_mac_time(time_t *tm, unsigned short *ms)
+    int audit_trail_get_dac_subject_name(const char **name) override
     {
-        time(tm); *ms = 0;
+        *name = "dac_subject_name";
         return 0;
     }
-    static int audit_trail_get_mac_subject_name(const char **name)
+    int audit_trail_get_dac_subject_owner(uid_t *uid, gid_t *gid) override
     {
-        *name = "mac_subject_name";
+        *uid = getuid(); *gid = getgid();
         return 0;
     }
-    static int audit_trail_get_mac_subject_label(const char **label)
+    int audit_trail_get_dac_subject_effective_owner(uid_t *euid, gid_t *egid) override
     {
-        *label = "mac_subject_label";
+        *euid = geteuid(); *egid = getegid();
         return 0;
     }
-    static int audit_trail_get_mac_subject_pid(pid_t *pid)
+    int audit_trail_get_dac_subject_pid(pid_t *pid) override
     {
         *pid = getpid();
         return 0;
     }
-    static int audit_trail_get_mac_object_name(const char **name)
+    int audit_trail_get_dac_object_name(const char **name) override
     {
-        *name = "mac_object_name";
+        *name = "dac_object_name";
         return 0;
     }
-    static int audit_trail_get_mac_object_label(const char **label)
+    int audit_trail_get_dac_object_owner(uid_t *uid, gid_t *gid) override
     {
-        *label = "mac_object_label";
+        *uid = getuid(); *gid = getgid();
         return 0;
     }
-    static int audit_trail_get_mac_action_syscall(unsigned int *syscall)
+    int audit_trail_get_dac_object_mode(mode_t *mode) override
     {
-        *syscall = 0;
+        *mode = 0;
         return 0;
     }
-    static int audit_trail_get_mac_action_request(const char **req)
+    int audit_trail_get_dac_action_syscall(unsigned int *syscall) override
     {
-        *req = "mac_action_request";
+        *syscall = 0;
         return 0;
     }
 
-    virtual int audit_trail_foreach_syscall(audit_trail_syscall_cb callback, void *user_data) = 0;
-    virtual int audit_trail_clear_syscall() = 0;
-    virtual int audit_trail_add_syscall_cb(audit_trail_syscall_cb callback, void* user_data, int* id) = 0;
-    virtual int audit_trail_remove_syscall_cb(int id) = 0;
-    virtual int audit_trail_enable_syscall(bool en) = 0;
-    virtual int audit_trail_is_enabled_syscall(bool *en) = 0;
-    static int audit_trail_get_syscall_time(time_t *tm, unsigned short *ms)
-    {
-        time(tm); *ms = 0;
-        return 0;
-    }
-    static int audit_trail_get_syscall_subject_name(const char **name)
+    int audit_trail_foreach_mac(audit_trail_mac_cb callback, void *user_data) override
     {
-        *name = "syscall_subject_name";
         return 0;
     }
-    static int audit_trail_get_syscall_subject_owner(uid_t *uid, gid_t *gid)
+    int audit_trail_clear_mac() override
     {
-        *uid = getuid(); *gid = getgid();
         return 0;
     }
-    static int audit_trail_get_syscall_subject_effective_owner(uid_t *euid, gid_t *egid)
+    int audit_trail_add_mac_cb(audit_trail_mac_cb callback, void* user_data, int* id) override
     {
-        *euid = geteuid(); *egid = getegid();
         return 0;
     }
-    static int audit_trail_get_syscall_subject_pid(pid_t *pid)
+    int audit_trail_remove_mac_cb(int id) override
     {
-        *pid = getpid();
         return 0;
     }
-    static int audit_trail_get_syscall_action_syscall(unsigned int *syscall)
+    int audit_trail_enable_mac(bool en) override
     {
-        *syscall = 0;
         return 0;
     }
-    static int audit_trail_get_syscall_action_exitcode(unsigned int *exit)
+    int audit_trail_is_enabled_mac(bool *en) override
     {
-        *exit = 0;
+        *en = true;
         return 0;
     }
-
-    virtual int audit_trail_foreach_user(audit_trail_user_cb callback, void *user_data) = 0;
-    virtual int audit_trail_clear_user() = 0;
-    virtual int audit_trail_add_user_cb(audit_trail_user_cb callback, void* user_data, int* id) = 0;
-    virtual int audit_trail_remove_user_cb(int id) = 0;
-    virtual int audit_trail_enable_user(bool en) = 0;
-    virtual int audit_trail_is_enabled_user(bool *en) = 0;
-    static int audit_trail_get_user_time(time_t *tm, unsigned short *ms)
+    int audit_trail_get_mac_time(time_t *tm, unsigned short *ms) override
     {
         time(tm); *ms = 0;
         return 0;
     }
-    static int audit_trail_get_user_log_type(int *type)
-    {
-        *type = 0;
-        return 0;
-    }
-    static int audit_trail_get_user_log_text(const char **text)
-    {
-        *text = "user_log_text";
-        return 0;
-    }
-};
-
-void audit_trail_set_implementation(IAuditTrail* impl);
-
-class AuditTrailDefaultImpl: public IAuditTrail
-{
-public:
-    int audit_trail_create(audit_trail_h *handle) override
+    int audit_trail_get_mac_subject_name(const char **name) override
     {
-        *handle = this;
+        *name = "mac_subject_name";
         return 0;
     }
-    int audit_trail_destroy() override
+    int audit_trail_get_mac_subject_label(const char **label) override
     {
+        *label = "mac_subject_label";
         return 0;
     }
-
-    int audit_trail_foreach_dac(audit_trail_dac_cb callback, void *user_data) override
+    int audit_trail_get_mac_subject_pid(pid_t *pid) override
     {
+        *pid = getpid();
         return 0;
     }
-    int audit_trail_clear_dac() override
+    int audit_trail_get_mac_object_name(const char **name) override
     {
+        *name = "mac_object_name";
         return 0;
     }
-    int audit_trail_add_dac_cb(audit_trail_dac_cb callback, void* user_data, int* id) override
+    int audit_trail_get_mac_object_label(const char **label) override
     {
+        *label = "mac_object_label";
         return 0;
     }
-    int audit_trail_remove_dac_cb(int id) override
+    int audit_trail_get_mac_action_syscall(unsigned int *syscall) override
     {
+        *syscall = 0;
         return 0;
     }
-    int audit_trail_enable_dac(bool en) override
+    int audit_trail_get_mac_action_request(const char **req) override
     {
+        *req = "mac_action_request";
         return 0;
     }
-    int audit_trail_is_enabled_dac(bool *en) override
+
+    int audit_trail_foreach_syscall(audit_trail_syscall_cb callback, void *user_data) override
     {
-        *en = true;
         return 0;
     }
-
-    int audit_trail_foreach_mac(audit_trail_mac_cb callback, void *user_data) override
+    int audit_trail_clear_syscall() override
     {
         return 0;
     }
-    int audit_trail_clear_mac() override
+    int audit_trail_add_syscall_cb(audit_trail_syscall_cb callback, void* user_data, int* id) override
     {
         return 0;
     }
-    int audit_trail_add_mac_cb(audit_trail_mac_cb callback, void* user_data, int* id) override
+    int audit_trail_remove_syscall_cb(int id) override
     {
         return 0;
     }
-    int audit_trail_remove_mac_cb(int id) override
+    int audit_trail_enable_syscall(bool en) override
     {
         return 0;
     }
-    int audit_trail_enable_mac(bool en) override
+    int audit_trail_is_enabled_syscall(bool *en) override
     {
+        *en = true;
         return 0;
     }
-    int audit_trail_is_enabled_mac(bool *en) override
+    int audit_trail_get_syscall_time(time_t *tm, unsigned short *ms) override
     {
-        *en = true;
+        time(tm); *ms = 0;
         return 0;
     }
-
-    int audit_trail_foreach_syscall(audit_trail_syscall_cb callback, void *user_data) override
+    int audit_trail_get_syscall_subject_name(const char **name) override
     {
+        *name = "syscall_subject_name";
         return 0;
     }
-    int audit_trail_clear_syscall() override
+    int audit_trail_get_syscall_subject_owner(uid_t *uid, gid_t *gid) override
     {
+        *uid = getuid(); *gid = getgid();
         return 0;
     }
-    int audit_trail_add_syscall_cb(audit_trail_syscall_cb callback, void* user_data, int* id) override
+    int audit_trail_get_syscall_subject_effective_owner(uid_t *euid, gid_t *egid) override
     {
+        *euid = geteuid(); *egid = getegid();
         return 0;
     }
-    int audit_trail_remove_syscall_cb(int id) override
+    int audit_trail_get_syscall_subject_pid(pid_t *pid) override
     {
+        *pid = getpid();
         return 0;
     }
-    int audit_trail_enable_syscall(bool en) override
+    int audit_trail_get_syscall_action_syscall(unsigned int *syscall) override
     {
+        *syscall = 0;
         return 0;
     }
-    int audit_trail_is_enabled_syscall(bool *en) override
+    int audit_trail_get_syscall_action_exitcode(unsigned int *exit) override
     {
-        *en = true;
+        *exit = 0;
         return 0;
     }
 
@@ -298,6 +310,21 @@ public:
         *en = true;
         return 0;
     }
+    int audit_trail_get_user_time(time_t *tm, unsigned short *ms) override
+    {
+        time(tm); *ms = 0;
+        return 0;
+    }
+    int audit_trail_get_user_log_type(int *type) override
+    {
+        *type = 0;
+        return 0;
+    }
+    int audit_trail_get_user_log_text(const char **text) override
+    {
+        *text = "user_log_text";
+        return 0;
+    }
 };
 
 #endif // AUDITTRAILSTUB_H
index e43c05f..1af1790 100644 (file)
@@ -71,33 +71,24 @@ TEST(Test_AuditTrailClient, start_auditing)
         EXPECT_CALL(atrail, audit_trail_enable_user(true)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
 
         EXPECT_CALL(atrail, audit_trail_is_enabled_dac(_))
-                .WillOnce(DoAll(
-                              SetArgPointee<0>(true),
-                              Return(AUDIT_TRAIL_ERROR_NONE)));
+                .WillOnce(DoAll(SetArgPointee<0>(true), Return(AUDIT_TRAIL_ERROR_NONE)));
         EXPECT_CALL(atrail, audit_trail_is_enabled_mac(_))
-                .WillOnce(DoAll(
-                              SetArgPointee<0>(true),
-                              Return(AUDIT_TRAIL_ERROR_NONE)));
+                .WillOnce(DoAll(SetArgPointee<0>(true), Return(AUDIT_TRAIL_ERROR_NONE)));
         EXPECT_CALL(atrail, audit_trail_is_enabled_user(_))
-                .WillOnce(DoAll(
-                              SetArgPointee<0>(true),
-                              Return(AUDIT_TRAIL_ERROR_NONE)));
+                .WillOnce(DoAll(SetArgPointee<0>(true), Return(AUDIT_TRAIL_ERROR_NONE)));
 
         EXPECT_CALL(atrail, audit_trail_add_dac_cb(_, _, _))
-                .WillOnce(DoAll(
-                              SetArgPointee<2>(DAC_CB_ID),
-                              WithArgs<0, 1>(Invoke(InvokeCallbackWithReportAdapter)),
-                              Return(AUDIT_TRAIL_ERROR_NONE)));
+                .WillOnce(DoAll(SetArgPointee<2>(DAC_CB_ID),
+                                WithArgs<0, 1>(Invoke(InvokeCallbackWithReportAdapter)),
+                                Return(AUDIT_TRAIL_ERROR_NONE)));
         EXPECT_CALL(atrail, audit_trail_add_mac_cb(_, _, _))
-                .WillOnce(DoAll(
-                              SetArgPointee<2>(MAC_CB_ID),
-                              WithArgs<0, 1>(Invoke(InvokeCallbackWithReportAdapter)),
-                              Return(AUDIT_TRAIL_ERROR_NONE)));
+                .WillOnce(DoAll(SetArgPointee<2>(MAC_CB_ID),
+                                WithArgs<0, 1>(Invoke(InvokeCallbackWithReportAdapter)),
+                                Return(AUDIT_TRAIL_ERROR_NONE)));
         EXPECT_CALL(atrail, audit_trail_add_user_cb(_, _, _))
-                .WillOnce(DoAll(
-                              SetArgPointee<2>(USER_CB_ID),
-                              WithArgs<0, 1>(Invoke(InvokeCallbackWithReportAdapter)),
-                              Return(AUDIT_TRAIL_ERROR_NONE)));
+                .WillOnce(DoAll(SetArgPointee<2>(USER_CB_ID),
+                                WithArgs<0, 1>(Invoke(InvokeCallbackWithReportAdapter)),
+                                Return(AUDIT_TRAIL_ERROR_NONE)));
 
         EXPECT_CALL(atrail, audit_trail_remove_dac_cb(Eq(DAC_CB_ID))).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
         EXPECT_CALL(atrail, audit_trail_remove_mac_cb(Eq(MAC_CB_ID))).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
@@ -184,7 +175,7 @@ TEST(Test_AuditTrailClient, syscall_auditing)
  * 2. Create AuditTrailClient
  * 3. Expect it fails with exception
  */
-TEST(Test_AuditTrailClient, audit_trail_create_fails)
+TEST(Test_AuditTrailClient, audit_trail_create_fault)
 {
     AuditTrailMock atrail;
     audit_trail_set_implementation(&atrail);
@@ -202,6 +193,481 @@ TEST(Test_AuditTrailClient, audit_trail_create_fails)
 }
 
 /**
+ * @brief TEST for AuditTrailClient when audit_trail_enable_dac fails
+ * 1. Create objects and mocks
+ * 2. Create AuditTrailClient
+ * 3. Expect it fails for start_auditing call
+ */
+TEST(Test_AuditTrailClient, start_auditing_enable_dac_fails)
+{
+    AuditTrailMock atrail;
+    audit_trail_set_implementation(&atrail);
+
+    {
+        ::testing::InSequence dummy;
+
+        EXPECT_CALL(atrail, audit_trail_create(_)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+
+        EXPECT_CALL(atrail, audit_trail_enable_dac(true)).WillOnce(Return(AUDIT_TRAIL_ERROR_CONNECTION_REFUSED));
+
+        EXPECT_CALL(atrail, audit_trail_destroy()).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+    }
+
+    ProxyThread proxy_thread;
+    ReportHandlerMock report_handler;
+
+    AuditTrailClient aclient(
+            DEVICE_ID,
+            &proxy_thread,
+            std::shared_ptr<ReportHandler>(&report_handler, [](ReportHandler*){}),
+            WorkingMode::Standard);
+    EXPECT_FALSE(aclient.start_auditing());
+}
+
+/**
+ * @brief TEST for AuditTrailClient when audit_trail_enable_mac fails
+ * 1. Create objects and mocks
+ * 2. Create AuditTrailClient
+ * 3. Expect it fails for start_auditing call
+ */
+TEST(Test_AuditTrailClient, start_auditing_enable_mac_fails)
+{
+    AuditTrailMock atrail;
+    audit_trail_set_implementation(&atrail);
+
+    {
+        ::testing::InSequence dummy;
+
+        EXPECT_CALL(atrail, audit_trail_create(_)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+
+        EXPECT_CALL(atrail, audit_trail_enable_dac(true)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+        EXPECT_CALL(atrail, audit_trail_enable_mac(true)).WillOnce(Return(AUDIT_TRAIL_ERROR_CONNECTION_REFUSED));
+
+        EXPECT_CALL(atrail, audit_trail_destroy()).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+    }
+
+    ProxyThread proxy_thread;
+    ReportHandlerMock report_handler;
+
+    AuditTrailClient aclient(
+            DEVICE_ID,
+            &proxy_thread,
+            std::shared_ptr<ReportHandler>(&report_handler, [](ReportHandler*){}),
+            WorkingMode::Standard);
+    EXPECT_FALSE(aclient.start_auditing());
+}
+
+/**
+ * @brief TEST for AuditTrailClient when audit_trail_enable_user fails
+ * 1. Create objects and mocks
+ * 2. Create AuditTrailClient
+ * 3. Expect it fails for start_auditing call
+ */
+TEST(Test_AuditTrailClient, start_auditing_enable_user_fails)
+{
+    AuditTrailMock atrail;
+    audit_trail_set_implementation(&atrail);
+
+    {
+        ::testing::InSequence dummy;
+
+        EXPECT_CALL(atrail, audit_trail_create(_)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+
+        EXPECT_CALL(atrail, audit_trail_enable_dac(true)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+        EXPECT_CALL(atrail, audit_trail_enable_mac(true)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+        EXPECT_CALL(atrail, audit_trail_enable_user(true)).WillOnce(Return(AUDIT_TRAIL_ERROR_CONNECTION_REFUSED));
+
+        EXPECT_CALL(atrail, audit_trail_destroy()).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+    }
+
+    ProxyThread proxy_thread;
+    ReportHandlerMock report_handler;
+
+    AuditTrailClient aclient(
+            DEVICE_ID,
+            &proxy_thread,
+            std::shared_ptr<ReportHandler>(&report_handler, [](ReportHandler*){}),
+            WorkingMode::Standard);
+    EXPECT_FALSE(aclient.start_auditing());
+}
+
+/**
+ * @brief TEST for AuditTrailClient when audit_trail_is_enabled_dac fails
+ * 1. Create objects and mocks
+ * 2. Create AuditTrailClient
+ * 3. Expect it fails for start_auditing call
+ */
+TEST(Test_AuditTrailClient, start_auditing_is_enabled_dac_fails)
+{
+    AuditTrailMock atrail;
+    audit_trail_set_implementation(&atrail);
+
+    {
+        ::testing::InSequence dummy;
+
+        EXPECT_CALL(atrail, audit_trail_create(_)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+
+        EXPECT_CALL(atrail, audit_trail_enable_dac(true)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+        EXPECT_CALL(atrail, audit_trail_enable_mac(true)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+        EXPECT_CALL(atrail, audit_trail_enable_user(true)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+
+        EXPECT_CALL(atrail, audit_trail_is_enabled_dac(_))
+                .WillOnce(DoAll(SetArgPointee<0>(false), Return(AUDIT_TRAIL_ERROR_CONNECTION_REFUSED)));
+
+        EXPECT_CALL(atrail, audit_trail_destroy()).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+    }
+
+    ProxyThread proxy_thread;
+    ReportHandlerMock report_handler;
+
+    AuditTrailClient aclient(
+            DEVICE_ID,
+            &proxy_thread,
+            std::shared_ptr<ReportHandler>(&report_handler, [](ReportHandler*){}),
+            WorkingMode::Standard);
+    EXPECT_FALSE(aclient.start_auditing());
+}
+
+/**
+ * @brief TEST for AuditTrailClient when audit_trail_is_enabled_mac fails
+ * 1. Create objects and mocks
+ * 2. Create AuditTrailClient
+ * 3. Expect it fails for start_auditing call
+ */
+TEST(Test_AuditTrailClient, start_auditing_is_enabled_mac_fails)
+{
+    AuditTrailMock atrail;
+    audit_trail_set_implementation(&atrail);
+
+    {
+        ::testing::InSequence dummy;
+
+        EXPECT_CALL(atrail, audit_trail_create(_)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+
+        EXPECT_CALL(atrail, audit_trail_enable_dac(true)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+        EXPECT_CALL(atrail, audit_trail_enable_mac(true)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+        EXPECT_CALL(atrail, audit_trail_enable_user(true)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+
+        EXPECT_CALL(atrail, audit_trail_is_enabled_dac(_))
+                .WillOnce(DoAll(SetArgPointee<0>(true), Return(AUDIT_TRAIL_ERROR_CONNECTION_REFUSED)));
+        EXPECT_CALL(atrail, audit_trail_is_enabled_mac(_))
+                .WillOnce(DoAll(SetArgPointee<0>(false), Return(AUDIT_TRAIL_ERROR_NONE)));
+
+        EXPECT_CALL(atrail, audit_trail_destroy()).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+    }
+
+    ProxyThread proxy_thread;
+    ReportHandlerMock report_handler;
+
+    AuditTrailClient aclient(
+            DEVICE_ID,
+            &proxy_thread,
+            std::shared_ptr<ReportHandler>(&report_handler, [](ReportHandler*){}),
+            WorkingMode::Standard);
+    EXPECT_FALSE(aclient.start_auditing());
+}
+
+/**
+ * @brief TEST for AuditTrailClient when audit_trail_is_enabled_user fails
+ * 1. Create objects and mocks
+ * 2. Create AuditTrailClient
+ * 3. Expect it fails for start_auditing call
+ */
+TEST(Test_AuditTrailClient, start_auditing_is_enabled_user_fails)
+{
+    AuditTrailMock atrail;
+    audit_trail_set_implementation(&atrail);
+
+    {
+        ::testing::InSequence dummy;
+
+        EXPECT_CALL(atrail, audit_trail_create(_)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+
+        EXPECT_CALL(atrail, audit_trail_enable_dac(true)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+        EXPECT_CALL(atrail, audit_trail_enable_mac(true)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+        EXPECT_CALL(atrail, audit_trail_enable_user(true)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+
+        EXPECT_CALL(atrail, audit_trail_is_enabled_dac(_))
+                .WillOnce(DoAll(SetArgPointee<0>(true), Return(AUDIT_TRAIL_ERROR_CONNECTION_REFUSED)));
+        EXPECT_CALL(atrail, audit_trail_is_enabled_mac(_))
+                .WillOnce(DoAll(SetArgPointee<0>(true), Return(AUDIT_TRAIL_ERROR_NONE)));
+        EXPECT_CALL(atrail, audit_trail_is_enabled_user(_))
+                .WillOnce(DoAll(SetArgPointee<0>(false), Return(AUDIT_TRAIL_ERROR_NONE)));
+
+        EXPECT_CALL(atrail, audit_trail_destroy()).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+    }
+
+    ProxyThread proxy_thread;
+    ReportHandlerMock report_handler;
+
+    AuditTrailClient aclient(
+            DEVICE_ID,
+            &proxy_thread,
+            std::shared_ptr<ReportHandler>(&report_handler, [](ReportHandler*){}),
+            WorkingMode::Standard);
+    EXPECT_FALSE(aclient.start_auditing());
+}
+
+/**
+ * @brief TEST for AuditTrailClient DAC log callback
+ * 1. Create objects and mocks
+ * 2. Create AuditTrailClient
+ * 3. Expect it fails for audit_trail_get_dac_ calls
+  */
+#define DAC_LOG_CALLBACK(_name, _r1, _r2, _r3, _r4, _r5, _r6, _r7, _r8, _r9) \
+    TEST(Test_AuditTrailClient, dac_log_callback_fails_##_name) \
+    { \
+        AuditTrailMock atrail; \
+        audit_trail_set_implementation(&atrail); \
+        { \
+            EXPECT_CALL(atrail, audit_trail_create(_)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE)); \
+            \
+            EXPECT_CALL(atrail, audit_trail_add_dac_cb(_, _, _)) \
+                    .WillOnce(DoAll(SetArgPointee<2>(DAC_CB_ID), \
+                                    WithArgs<0, 1>(Invoke(InvokeCallbackWithReportAdapter)), \
+                                    Return(AUDIT_TRAIL_ERROR_NONE))); \
+            \
+            switch(_name) \
+            { \
+            case 9: \
+                EXPECT_CALL(atrail, audit_trail_get_dac_action_syscall(_)).WillOnce(Return(_r9)); \
+            case 8: \
+                EXPECT_CALL(atrail, audit_trail_get_dac_object_mode(_)).WillOnce(Return(_r8)); \
+            case 7: \
+                EXPECT_CALL(atrail, audit_trail_get_dac_object_owner(_, _)).WillOnce(Return(_r7)); \
+            case 6: \
+                EXPECT_CALL(atrail, audit_trail_get_dac_object_name(_)).WillOnce(Return(_r6)); \
+            case 5: \
+                EXPECT_CALL(atrail, audit_trail_get_dac_subject_pid(_)).WillOnce(Return(_r5)); \
+            case 4: \
+                EXPECT_CALL(atrail, audit_trail_get_dac_subject_effective_owner(_, _)).WillOnce(Return(_r4)); \
+            case 3: \
+                EXPECT_CALL(atrail, audit_trail_get_dac_subject_owner(_, _)).WillOnce(Return(_r3)); \
+            case 2: \
+                EXPECT_CALL(atrail, audit_trail_get_dac_subject_name(_)).WillOnce(Return(_r2)); \
+            case 1: \
+                EXPECT_CALL(atrail, audit_trail_get_dac_time(_, _)).WillOnce(Return(_r1)); \
+            } \
+            \
+            EXPECT_CALL(atrail, audit_trail_remove_dac_cb(Eq(DAC_CB_ID))).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE)); \
+            \
+            EXPECT_CALL(atrail, audit_trail_destroy()).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE)); \
+        } \
+        \
+        ProxyThread proxy_thread; \
+        ReportHandlerMock report_handler; \
+        \
+        AuditTrailClient aclient(DEVICE_ID, \
+                                &proxy_thread, \
+                                std::shared_ptr<ReportHandler>(&report_handler, [](ReportHandler*){}), \
+                                WorkingMode::Standard); \
+        EXPECT_TRUE(aclient.start_dac_auditing()); \
+        EXPECT_NO_THROW(aclient.stop_dac_auditing()); \
+} \
+
+DAC_LOG_CALLBACK(1, 1, 0, 0, 0, 0, 0, 0, 0, 0)
+DAC_LOG_CALLBACK(2, 0, 1, 0, 0, 0, 0, 0, 0, 0)
+DAC_LOG_CALLBACK(3, 0, 0, 1, 0, 0, 0, 0, 0, 0)
+DAC_LOG_CALLBACK(4, 0, 0, 0, 1, 0, 0, 0, 0, 0)
+DAC_LOG_CALLBACK(5, 0, 0, 0, 0, 1, 0, 0, 0, 0)
+DAC_LOG_CALLBACK(6, 0, 0, 0, 0, 0, 1, 0, 0, 0)
+DAC_LOG_CALLBACK(7, 0, 0, 0, 0, 0, 0, 1, 0, 0)
+DAC_LOG_CALLBACK(8, 0, 0, 0, 0, 0, 0, 0, 1, 0)
+DAC_LOG_CALLBACK(9, 0, 0, 0, 0, 0, 0, 0, 0, 1)
+
+/**
+ * @brief TEST for AuditTrailClient MAC log callback
+ * 1. Create objects and mocks
+ * 2. Create AuditTrailClient
+ * 3. Expect it fails for audit_trail_get_mac_ calls
+  */
+#define MAC_LOG_CALLBACK(_name, _r1, _r2, _r3, _r4, _r5, _r6, _r7, _r8) \
+    TEST(Test_AuditTrailClient, mac_log_callback_fails_##_name) \
+    { \
+        AuditTrailMock atrail; \
+        audit_trail_set_implementation(&atrail); \
+        { \
+            EXPECT_CALL(atrail, audit_trail_create(_)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE)); \
+            \
+            EXPECT_CALL(atrail, audit_trail_add_mac_cb(_, _, _)) \
+                    .WillOnce(DoAll(SetArgPointee<2>(MAC_CB_ID), \
+                                    WithArgs<0, 1>(Invoke(InvokeCallbackWithReportAdapter)), \
+                                    Return(AUDIT_TRAIL_ERROR_NONE))); \
+            \
+            switch(_name) \
+            { \
+            case 8: \
+                EXPECT_CALL(atrail, audit_trail_get_mac_action_request(_)).WillOnce(Return(_r8)); \
+            case 7: \
+                EXPECT_CALL(atrail, audit_trail_get_mac_action_syscall(_)).WillOnce(Return(_r7)); \
+            case 6: \
+                EXPECT_CALL(atrail, audit_trail_get_mac_object_label(_)).WillOnce(Return(_r6)); \
+            case 5: \
+                EXPECT_CALL(atrail, audit_trail_get_mac_object_name(_)).WillOnce(Return(_r5)); \
+            case 4: \
+                EXPECT_CALL(atrail, audit_trail_get_mac_subject_pid(_)).WillOnce(Return(_r4)); \
+            case 3: \
+                EXPECT_CALL(atrail, audit_trail_get_mac_subject_label(_)).WillOnce(Return(_r3)); \
+            case 2: \
+                EXPECT_CALL(atrail, audit_trail_get_mac_subject_name(_)).WillOnce(Return(_r2)); \
+            case 1: \
+                EXPECT_CALL(atrail, audit_trail_get_mac_time(_, _)).WillOnce(Return(_r1)); \
+            } \
+            \
+            EXPECT_CALL(atrail, audit_trail_remove_mac_cb(Eq(MAC_CB_ID))).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE)); \
+            \
+            EXPECT_CALL(atrail, audit_trail_destroy()).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE)); \
+        } \
+        \
+        ProxyThread proxy_thread; \
+        ReportHandlerMock report_handler; \
+        \
+        AuditTrailClient aclient(DEVICE_ID, \
+                                &proxy_thread, \
+                                std::shared_ptr<ReportHandler>(&report_handler, [](ReportHandler*){}), \
+                                WorkingMode::Standard); \
+        EXPECT_TRUE(aclient.start_mac_auditing()); \
+        EXPECT_NO_THROW(aclient.stop_mac_auditing()); \
+} \
+
+MAC_LOG_CALLBACK(1, 1, 0, 0, 0, 0, 0, 0, 0)
+MAC_LOG_CALLBACK(2, 0, 1, 0, 0, 0, 0, 0, 0)
+MAC_LOG_CALLBACK(3, 0, 0, 1, 0, 0, 0, 0, 0)
+MAC_LOG_CALLBACK(4, 0, 0, 0, 1, 0, 0, 0, 0)
+MAC_LOG_CALLBACK(5, 0, 0, 0, 0, 1, 0, 0, 0)
+MAC_LOG_CALLBACK(6, 0, 0, 0, 0, 0, 1, 0, 0)
+MAC_LOG_CALLBACK(7, 0, 0, 0, 0, 0, 0, 1, 0)
+MAC_LOG_CALLBACK(8, 0, 0, 0, 0, 0, 0, 0, 1)
+
+/**
+ * @brief TEST for AuditTrailClient syscall log callback
+ * 1. Create objects and mocks
+ * 2. Create AuditTrailClient
+ * 3. Expect it fails for audit_trail_get_syscall_ calls
+  */
+#define SYSCALL_LOG_CALLBACK(_name, _r1, _r2, _r3, _r4, _r5, _r6, _r7) \
+    TEST(Test_AuditTrailClient, syscall_log_callback_fails_##_name) \
+    { \
+        AuditTrailMock atrail; \
+        audit_trail_set_implementation(&atrail); \
+        { \
+            EXPECT_CALL(atrail, audit_trail_create(_)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE)); \
+            \
+            EXPECT_CALL(atrail, audit_trail_add_syscall_cb(_, _, _)) \
+                    .WillOnce(DoAll(SetArgPointee<2>(SYSCALL_CB_ID), \
+                                    WithArgs<0, 1>(Invoke(InvokeCallbackWithReportAdapter)), \
+                                    Return(AUDIT_TRAIL_ERROR_NONE))); \
+            \
+            switch(_name) \
+            { \
+            case 7: \
+                EXPECT_CALL(atrail, audit_trail_get_syscall_action_exitcode(_)).WillOnce(Return(_r7)); \
+            case 6: \
+                EXPECT_CALL(atrail, audit_trail_get_syscall_action_syscall(_)).WillOnce(Return(_r6)); \
+            case 5: \
+                EXPECT_CALL(atrail, audit_trail_get_syscall_subject_pid(_)).WillOnce(Return(_r5)); \
+            case 4: \
+                EXPECT_CALL(atrail, audit_trail_get_syscall_subject_effective_owner(_, _)).WillOnce(Return(_r4)); \
+            case 3: \
+                EXPECT_CALL(atrail, audit_trail_get_syscall_subject_owner(_, _)).WillOnce(Return(_r3)); \
+            case 2: \
+                EXPECT_CALL(atrail, audit_trail_get_syscall_subject_name(_)).WillOnce(Return(_r2)); \
+            case 1: \
+                EXPECT_CALL(atrail, audit_trail_get_syscall_time(_, _)).WillOnce(Return(_r1)); \
+            } \
+            \
+            EXPECT_CALL(atrail, audit_trail_remove_syscall_cb(Eq(SYSCALL_CB_ID))).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE)); \
+            \
+            EXPECT_CALL(atrail, audit_trail_destroy()).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE)); \
+        } \
+        \
+        ProxyThread proxy_thread; \
+        ReportHandlerMock report_handler; \
+        \
+        AuditTrailClient aclient(DEVICE_ID, \
+                                &proxy_thread, \
+                                std::shared_ptr<ReportHandler>(&report_handler, [](ReportHandler*){}), \
+                                WorkingMode::Standard); \
+        EXPECT_TRUE(aclient.start_syscall_auditing()); \
+        EXPECT_NO_THROW(aclient.stop_syscall_auditing()); \
+} \
+
+SYSCALL_LOG_CALLBACK(1, 1, 0, 0, 0, 0, 0, 0)
+SYSCALL_LOG_CALLBACK(2, 0, 1, 0, 0, 0, 0, 0)
+SYSCALL_LOG_CALLBACK(3, 0, 0, 1, 0, 0, 0, 0)
+SYSCALL_LOG_CALLBACK(4, 0, 0, 0, 1, 0, 0, 0)
+SYSCALL_LOG_CALLBACK(5, 0, 0, 0, 0, 1, 0, 0)
+SYSCALL_LOG_CALLBACK(6, 0, 0, 0, 0, 0, 1, 0)
+SYSCALL_LOG_CALLBACK(7, 0, 0, 0, 0, 0, 0, 1)
+
+/**
+ * @brief TEST for AuditTrailClient user log callback
+ * 1. Create objects and mocks
+ * 2. Create AuditTrailClient
+ * 3. Expect it fails for audit_trail_get_user_ calls
+  */
+#define USER_LOG_CALLBACK(_name, _r1, _r2, _r3) \
+    TEST(Test_AuditTrailClient, user_log_user_fails_##_name) \
+    { \
+        AuditTrailMock atrail; \
+        audit_trail_set_implementation(&atrail); \
+        { \
+            EXPECT_CALL(atrail, audit_trail_create(_)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE)); \
+            \
+            EXPECT_CALL(atrail, audit_trail_add_user_cb(_, _, _)) \
+                    .WillOnce(DoAll(SetArgPointee<2>(USER_CB_ID), \
+                                    WithArgs<0, 1>(Invoke(InvokeCallbackWithReportAdapter)), \
+                                    Return(AUDIT_TRAIL_ERROR_NONE))); \
+            \
+            switch(_name) \
+            { \
+            case 3: \
+                EXPECT_CALL(atrail, audit_trail_get_user_log_text(_)).WillOnce(Return(_r3)); \
+            case 2: \
+                EXPECT_CALL(atrail, audit_trail_get_user_log_type(_)).WillOnce(Return(_r2)); \
+            case 1: \
+                EXPECT_CALL(atrail, audit_trail_get_user_time(_, _)).WillOnce(Return(_r1)); \
+            } \
+            \
+            EXPECT_CALL(atrail, audit_trail_remove_user_cb(Eq(USER_CB_ID))).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE)); \
+            \
+            EXPECT_CALL(atrail, audit_trail_destroy()).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE)); \
+        } \
+        \
+        ProxyThread proxy_thread; \
+        ReportHandlerMock report_handler; \
+        \
+        AuditTrailClient aclient(DEVICE_ID, \
+                                &proxy_thread, \
+                                std::shared_ptr<ReportHandler>(&report_handler, [](ReportHandler*){}), \
+                                WorkingMode::Standard); \
+        EXPECT_TRUE(aclient.start_user_auditing()); \
+        EXPECT_NO_THROW(aclient.stop_user_auditing()); \
+} \
+
+USER_LOG_CALLBACK(1, 1, 0, 0)
+USER_LOG_CALLBACK(2, 0, 1, 0)
+USER_LOG_CALLBACK(3, 0, 0, 1)
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+#if 0
+/**
  * @brief TEST for dac auditing when start_dac_auditing fauls
  * 1. Create objects and mocks
  * 2. Run start dac auditing
@@ -219,6 +685,7 @@ TEST(Test_AuditTrailClient, dac_auditing_fault)
         ::testing::InSequence dummy;
 
         EXPECT_CALL(atrail, audit_trail_create(_)).WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
+
         EXPECT_CALL(atrail, audit_trail_enable_dac(true))
                 .WillOnce(Return(AUDIT_TRAIL_ERROR_CONNECTION_REFUSED))
                 .WillOnce(Return(AUDIT_TRAIL_ERROR_NONE));
@@ -313,3 +780,4 @@ TEST(Test_AuditTrailClient, syscall_auditing_fault)
     EXPECT_FALSE(aclient.start_syscall_auditing());
     EXPECT_FALSE(aclient.start_syscall_auditing());
 }
+#endif