Tree 5 (filesystem)

Explanation

This page shows the content of a tree. It is essentially a list of items, each of which consist of a key and a value.

The key is shown in the boxes on the left. It is a triple of a 64-bit id, an 8-bit type, and a 64-bit offset. What each of them means depends on the tree we're in. You can search for a key id by using the search field below.

The value is summarized to the right of the key. To see the value in more detail, unfold the key by clicking on it.

Finally, to the very right, we have the logical address of the metadata node which the item is stored in.

go back to root tree
first
prev
3AF6ExtentData (6C)0external, length 48 KiB3AEC000

48 KiB on disk, starting at offset 0 within the extent at address 4FFF4000; 48 KiB in the file starting from offset 0.

compression0
encryption0
other_encoding0
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 49152,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 1,
        },
        data: External(
            ExternalExtent {
                disk_bytenr: 1342128128,
                disk_num_bytes: 49152,
                offset: 0,
                num_bytes: 49152,
            },
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 00 01 00 40 FF 4F 00 00 00 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00 00 00 00
3AF7Inode (01)0regular file, mode 07553AEC000
size129080
mode33261
uid0
gid0
nlink1
atime1708913572
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 9,
        size: 129080,
        nbytes: 131072,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 33261,
        rdev: 0,
        flags: 0,
        sequence: 22073,
        atime: Time {
            sec: 1708913572,
            nsec: 0,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 38 F8 01 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ED 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 39 56 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38
3AF7Ref (0C)25B["auditd"]3AEC000
name"auditd"
index125
show full value
Ref(
    [
        RefItem {
            index: 125,
            name_len: 6,
            name: "auditd",
        },
    ],
)
show hex data
7D 00 00 00 00 00 00 00 06 00 61 75 64 69 74 64
3AF7ExtentData (6C)0external, length 128 KiB3AEC000

128 KiB on disk, starting at offset 0 within the extent at address 50000000; 128 KiB in the file starting from offset 0.

compression0
encryption0
other_encoding0
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 131072,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 1,
        },
        data: External(
            ExternalExtent {
                disk_bytenr: 1342177280,
                disk_num_bytes: 131072,
                offset: 0,
                num_bytes: 131072,
            },
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 01 00 00 00 50 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00
3AF8Inode (01)0regular file, mode 07553AEC000
size3836
mode33261
uid0
gid0
nlink1
atime1708913572
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 9,
        size: 3836,
        nbytes: 4096,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 33261,
        rdev: 0,
        flags: 0,
        sequence: 102,
        atime: Time {
            sec: 1708913572,
            nsec: 0,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 FC 0E 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ED 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38
3AF8Ref (0C)25B["augenrules"]3AEC000
name"augenrules"
index126
show full value
Ref(
    [
        RefItem {
            index: 126,
            name_len: 10,
            name: "augenrules",
        },
    ],
)
show hex data
7E 00 00 00 00 00 00 00 0A 00 61 75 67 65 6E 72 75 6C 65 73
3AF8ExtentData (6C)0external, length 4 KiB3AEC000

4 KiB on disk, starting at offset 0 within the extent at address 50020000; 4 KiB in the file starting from offset 0.

compression0
encryption0
other_encoding0
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 4096,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 1,
        },
        data: External(
            ExternalExtent {
                disk_bytenr: 1342308352,
                disk_num_bytes: 4096,
                offset: 0,
                num_bytes: 4096,
            },
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 01 00 00 02 50 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00
3AF9Inode (01)0regular file, mode 07553AEC000
size18376
mode33261
uid0
gid0
nlink1
atime1708913572
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 9,
        size: 18376,
        nbytes: 20480,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 33261,
        rdev: 0,
        flags: 0,
        sequence: 101,
        atime: Time {
            sec: 1708913572,
            nsec: 0,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 C8 47 00 00 00 00 00 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ED 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38
3AF9Ref (0C)25B["aulast"]3AEC000
name"aulast"
index127
show full value
Ref(
    [
        RefItem {
            index: 127,
            name_len: 6,
            name: "aulast",
        },
    ],
)
show hex data
7F 00 00 00 00 00 00 00 06 00 61 75 6C 61 73 74
3AF9ExtentData (6C)0external, length 20 KiB3AEC000

20 KiB on disk, starting at offset 0 within the extent at address 50021000; 20 KiB in the file starting from offset 0.

compression0
encryption0
other_encoding0
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 20480,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 1,
        },
        data: External(
            ExternalExtent {
                disk_bytenr: 1342312448,
                disk_num_bytes: 20480,
                offset: 0,
                num_bytes: 20480,
            },
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 00 50 00 00 00 00 00 00 00 00 00 00 01 00 10 02 50 00 00 00 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 00 00 00 00 00 00
3AFAInode (01)0regular file, mode 07553AEC000
size14280
mode33261
uid0
gid0
nlink1
atime1708913572
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 9,
        size: 14280,
        nbytes: 16384,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 33261,
        rdev: 0,
        flags: 0,
        sequence: 128,
        atime: Time {
            sec: 1708913572,
            nsec: 0,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 C8 37 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ED 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38
3AFARef (0C)25B["aulastlog"]3AEC000
name"aulastlog"
index128
show full value
Ref(
    [
        RefItem {
            index: 128,
            name_len: 9,
            name: "aulastlog",
        },
    ],
)
show hex data
80 00 00 00 00 00 00 00 09 00 61 75 6C 61 73 74 6C 6F 67
3AFAExtentData (6C)0external, length 16 KiB3AEC000

16 KiB on disk, starting at offset 0 within the extent at address 50026000; 16 KiB in the file starting from offset 0.

compression0
encryption0
other_encoding0
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 16384,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 1,
        },
        data: External(
            ExternalExtent {
                disk_bytenr: 1342332928,
                disk_num_bytes: 16384,
                offset: 0,
                num_bytes: 16384,
            },
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 01 00 60 02 50 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00
3AFBInode (01)0regular file, mode 07553AEC000
size112688
mode33261
uid0
gid0
nlink1
atime1708913572
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 9,
        size: 112688,
        nbytes: 114688,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 33261,
        rdev: 0,
        flags: 0,
        sequence: 183,
        atime: Time {
            sec: 1708913572,
            nsec: 0,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 30 B8 01 00 00 00 00 00 00 C0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ED 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38
3AFBRef (0C)25B["aureport"]3AEC000
name"aureport"
index129
show full value
Ref(
    [
        RefItem {
            index: 129,
            name_len: 8,
            name: "aureport",
        },
    ],
)
show hex data
81 00 00 00 00 00 00 00 08 00 61 75 72 65 70 6F 72 74
3AFBExtentData (6C)0external, length 112 KiB3AEC000

112 KiB on disk, starting at offset 0 within the extent at address 5002A000; 112 KiB in the file starting from offset 0.

compression0
encryption0
other_encoding0
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 114688,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 1,
        },
        data: External(
            ExternalExtent {
                disk_bytenr: 1342349312,
                disk_num_bytes: 114688,
                offset: 0,
                num_bytes: 114688,
            },
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 00 C0 01 00 00 00 00 00 00 00 00 00 01 00 A0 02 50 00 00 00 00 00 C0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 01 00 00 00 00 00
3AFCInode (01)0regular file, mode 07553AEC000
size112744
mode33261
uid0
gid0
nlink1
atime1708913572
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 9,
        size: 112744,
        nbytes: 114688,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 33261,
        rdev: 0,
        flags: 0,
        sequence: 115,
        atime: Time {
            sec: 1708913572,
            nsec: 0,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 68 B8 01 00 00 00 00 00 00 C0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ED 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38
3AFCRef (0C)25B["ausearch"]3AEC000
name"ausearch"
index130
show full value
Ref(
    [
        RefItem {
            index: 130,
            name_len: 8,
            name: "ausearch",
        },
    ],
)
show hex data
82 00 00 00 00 00 00 00 08 00 61 75 73 65 61 72 63 68
3AFCExtentData (6C)0external, length 112 KiB3AEC000

112 KiB on disk, starting at offset 0 within the extent at address 50046000; 112 KiB in the file starting from offset 0.

compression0
encryption0
other_encoding0
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 114688,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 1,
        },
        data: External(
            ExternalExtent {
                disk_bytenr: 1342464000,
                disk_num_bytes: 114688,
                offset: 0,
                num_bytes: 114688,
            },
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 00 C0 01 00 00 00 00 00 00 00 00 00 01 00 60 04 50 00 00 00 00 00 C0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 01 00 00 00 00 00
3AFDInode (01)0regular file, mode 07553AEC000
size14280
mode33261
uid0
gid0
nlink1
atime1708913572
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 9,
        size: 14280,
        nbytes: 16384,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 33261,
        rdev: 0,
        flags: 0,
        sequence: 146,
        atime: Time {
            sec: 1708913572,
            nsec: 0,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 C8 37 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ED 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 92 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38
3AFDRef (0C)25B["ausyscall"]3AEC000
name"ausyscall"
index131
show full value
Ref(
    [
        RefItem {
            index: 131,
            name_len: 9,
            name: "ausyscall",
        },
    ],
)
show hex data
83 00 00 00 00 00 00 00 09 00 61 75 73 79 73 63 61 6C 6C
3AFDExtentData (6C)0external, length 16 KiB3AEC000

16 KiB on disk, starting at offset 0 within the extent at address 50062000; 16 KiB in the file starting from offset 0.

compression0
encryption0
other_encoding0
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 16384,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 1,
        },
        data: External(
            ExternalExtent {
                disk_bytenr: 1342578688,
                disk_num_bytes: 16384,
                offset: 0,
                num_bytes: 16384,
            },
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 01 00 20 06 50 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00
3AFEInode (01)0regular file, mode 06443AEC000
size13786
mode33188
uid0
gid0
nlink1
atime1708913572
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 9,
        size: 13786,
        nbytes: 16384,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 33188,
        rdev: 0,
        flags: 0,
        sequence: 54,
        atime: Time {
            sec: 1708913572,
            nsec: 0,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 DA 35 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 A4 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38
3AFERef (0C)25C["audit-records.h"]3AEC000
name"audit-records.h"
index211
show full value
Ref(
    [
        RefItem {
            index: 211,
            name_len: 15,
            name: "audit-records.h",
        },
    ],
)
show hex data
D3 00 00 00 00 00 00 00 0F 00 61 75 64 69 74 2D 72 65 63 6F 72 64 73 2E 68
3AFEExtentData (6C)0external, length 16 KiB3AEC000

16 KiB on disk, starting at offset 0 within the extent at address 50066000; 16 KiB in the file starting from offset 0.

compression0
encryption0
other_encoding0
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 16384,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 1,
        },
        data: External(
            ExternalExtent {
                disk_bytenr: 1342595072,
                disk_num_bytes: 16384,
                offset: 0,
                num_bytes: 16384,
            },
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 01 00 60 06 50 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00
3AFFInode (01)0regular file, mode 06443AEC000
size3157
mode33188
uid0
gid0
nlink1
atime1708913572
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 9,
        size: 3157,
        nbytes: 4096,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 33188,
        rdev: 0,
        flags: 0,
        sequence: 17,
        atime: Time {
            sec: 1708913572,
            nsec: 0,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 944181338,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 55 0C 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 A4 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 44 ED 79 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 5A 10 47 38
3AFFRef (0C)25C["audit_logging.h"]3AEC000
name"audit_logging.h"
index212
show full value
Ref(
    [
        RefItem {
            index: 212,
            name_len: 15,
            name: "audit_logging.h",
        },
    ],
)
show hex data
D4 00 00 00 00 00 00 00 0F 00 61 75 64 69 74 5F 6C 6F 67 67 69 6E 67 2E 68
3AFFExtentData (6C)0external, length 4 KiB3AEC000

4 KiB on disk, starting at offset 0 within the extent at address 5006A000; 4 KiB in the file starting from offset 0.

compression0
encryption0
other_encoding0
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 4096,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 1,
        },
        data: External(
            ExternalExtent {
                disk_bytenr: 1342611456,
                disk_num_bytes: 4096,
                offset: 0,
                num_bytes: 4096,
            },
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 01 00 A0 06 50 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00
3B00Inode (01)0regular file, mode 06443AEC000
size4055
mode33188
uid0
gid0
nlink1
atime1708913572
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 9,
        size: 4055,
        nbytes: 4096,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 33188,
        rdev: 0,
        flags: 0,
        sequence: 77,
        atime: Time {
            sec: 1708913572,
            nsec: 0,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 D7 0F 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 A4 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 44 ED 79 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 44 ED 79 38
3B00Ref (0C)25C["auparse-defs.h"]3AEC000
name"auparse-defs.h"
index213
show full value
Ref(
    [
        RefItem {
            index: 213,
            name_len: 14,
            name: "auparse-defs.h",
        },
    ],
)
show hex data
D5 00 00 00 00 00 00 00 0E 00 61 75 70 61 72 73 65 2D 64 65 66 73 2E 68
3B00ExtentData (6C)0external, length 4 KiB3AEC000

4 KiB on disk, starting at offset 0 within the extent at address 5006B000; 4 KiB in the file starting from offset 0.

compression0
encryption0
other_encoding0
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 4096,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 1,
        },
        data: External(
            ExternalExtent {
                disk_bytenr: 1342615552,
                disk_num_bytes: 4096,
                offset: 0,
                num_bytes: 4096,
            },
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 01 00 B0 06 50 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00
3B01Inode (01)0regular file, mode 06443AEC000
size7440
mode33188
uid0
gid0
nlink1
atime1708913572
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 9,
        size: 7440,
        nbytes: 8192,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 33188,
        rdev: 0,
        flags: 0,
        sequence: 41,
        atime: Time {
            sec: 1708913572,
            nsec: 0,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 10 1D 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 A4 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 44 ED 79 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 44 ED 79 38
3B01Ref (0C)25C["auparse.h"]3AEC000
name"auparse.h"
index214
show full value
Ref(
    [
        RefItem {
            index: 214,
            name_len: 9,
            name: "auparse.h",
        },
    ],
)
show hex data
D6 00 00 00 00 00 00 00 09 00 61 75 70 61 72 73 65 2E 68
3B01ExtentData (6C)0external, length 8 KiB3AEC000

8 KiB on disk, starting at offset 0 within the extent at address 5006C000; 8 KiB in the file starting from offset 0.

compression0
encryption0
other_encoding0
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 8192,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 1,
        },
        data: External(
            ExternalExtent {
                disk_bytenr: 1342619648,
                disk_num_bytes: 8192,
                offset: 0,
                num_bytes: 8192,
            },
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 01 00 C0 06 50 00 00 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00
3B02Inode (01)0regular file, mode 06443AEC000
size10306
mode33188
uid0
gid0
nlink1
atime1708913572
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 9,
        size: 10306,
        nbytes: 12288,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 33188,
        rdev: 0,
        flags: 0,
        sequence: 102,
        atime: Time {
            sec: 1708913572,
            nsec: 0,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 09 00 00 00 00 00 00 00 42 28 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 A4 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 44 ED 79 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 44 ED 79 38
3B02Ref (0C)25C["libaudit.h"]3AEC000
name"libaudit.h"
index215
show full value
Ref(
    [
        RefItem {
            index: 215,
            name_len: 10,
            name: "libaudit.h",
        },
    ],
)
show hex data
D7 00 00 00 00 00 00 00 0A 00 6C 69 62 61 75 64 69 74 2E 68
3B02ExtentData (6C)0external, length 12 KiB3AEC000

12 KiB on disk, starting at offset 0 within the extent at address 5006E000; 12 KiB in the file starting from offset 0.

compression0
encryption0
other_encoding0
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 12288,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 1,
        },
        data: External(
            ExternalExtent {
                disk_bytenr: 1342627840,
                disk_num_bytes: 12288,
                offset: 0,
                num_bytes: 12288,
            },
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 00 30 00 00 00 00 00 00 00 00 00 00 01 00 E0 06 50 00 00 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 00 00 00 00 00 00
3B03Inode (01)0symbolic link, mode 07773AEC000
size17
mode41471
uid0
gid0
nlink1
atime1708913585
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 10,
        size: 17,
        nbytes: 17,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 41471,
        rdev: 0,
        flags: 0,
        sequence: 83,
        atime: Time {
            sec: 1708913585,
            nsec: 477590212,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 FF A1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 53 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B1 F3 DB 65 00 00 00 00 C4 72 77 1C A4 F3 DB 65 00 00 00 00 44 ED 79 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 44 ED 79 38
3B03Ref (0C)25D["libaudit.so"]3AEC000
name"libaudit.so"
index288
show full value
Ref(
    [
        RefItem {
            index: 288,
            name_len: 11,
            name: "libaudit.so",
        },
    ],
)
show hex data
20 01 00 00 00 00 00 00 0B 00 6C 69 62 61 75 64 69 74 2E 73 6F
3B03ExtentData (6C)0inline, length 17 B3AEC000
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 17,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 0,
        },
        data: Inline(
            [
                108,
                105,
                98,
                97,
                117,
                100,
                105,
                116,
                46,
                115,
                111,
                46,
                49,
                46,
                48,
                46,
                48,
            ],
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 00 6C 69 62 61 75 64 69 74 2E 73 6F 2E 31 2E 30 2E 30
3B04Inode (01)0symbolic link, mode 07773AEC000
size17
mode41471
uid0
gid0
nlink1
atime1708913584
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 10,
        size: 17,
        nbytes: 17,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 41471,
        rdev: 0,
        flags: 0,
        sequence: 53,
        atime: Time {
            sec: 1708913584,
            nsec: 370916869,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 FF A1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 35 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B0 F3 DB 65 00 00 00 00 05 BE 1B 16 A4 F3 DB 65 00 00 00 00 44 ED 79 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 44 ED 79 38
3B04Ref (0C)25D["libaudit.so.1"]3AEC000
name"libaudit.so.1"
index289
show full value
Ref(
    [
        RefItem {
            index: 289,
            name_len: 13,
            name: "libaudit.so.1",
        },
    ],
)
show hex data
21 01 00 00 00 00 00 00 0D 00 6C 69 62 61 75 64 69 74 2E 73 6F 2E 31
3B04ExtentData (6C)0inline, length 17 B3AEC000
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 17,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 0,
        },
        data: Inline(
            [
                108,
                105,
                98,
                97,
                117,
                100,
                105,
                116,
                46,
                115,
                111,
                46,
                49,
                46,
                48,
                46,
                48,
            ],
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 00 6C 69 62 61 75 64 69 74 2E 73 6F 2E 31 2E 30 2E 30
3B05Inode (01)0regular file, mode 07553AEC000
size124808
mode33261
uid0
gid0
nlink1
atime1708913584
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 10,
        size: 124808,
        nbytes: 126976,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 33261,
        rdev: 0,
        flags: 0,
        sequence: 59,
        atime: Time {
            sec: 1708913584,
            nsec: 370916869,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 88 E7 01 00 00 00 00 00 00 F0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 ED 81 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B0 F3 DB 65 00 00 00 00 05 BE 1B 16 A4 F3 DB 65 00 00 00 00 44 ED 79 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 44 ED 79 38
3B05Ref (0C)25D["libaudit.so.1.0.0"]3AEC000
name"libaudit.so.1.0.0"
index290
show full value
Ref(
    [
        RefItem {
            index: 290,
            name_len: 17,
            name: "libaudit.so.1.0.0",
        },
    ],
)
show hex data
22 01 00 00 00 00 00 00 11 00 6C 69 62 61 75 64 69 74 2E 73 6F 2E 31 2E 30 2E 30
3B05ExtentData (6C)0external, length 124 KiB3AEC000

124 KiB on disk, starting at offset 0 within the extent at address 50071000; 124 KiB in the file starting from offset 0.

compression0
encryption0
other_encoding0
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 126976,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 1,
        },
        data: External(
            ExternalExtent {
                disk_bytenr: 1342640128,
                disk_num_bytes: 126976,
                offset: 0,
                num_bytes: 126976,
            },
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 00 F0 01 00 00 00 00 00 00 00 00 00 01 00 10 07 50 00 00 00 00 00 F0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F0 01 00 00 00 00 00
3B06Inode (01)0symbolic link, mode 07773AEC000
size19
mode41471
uid0
gid0
nlink1
atime1708913585
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 10,
        size: 19,
        nbytes: 19,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 41471,
        rdev: 0,
        flags: 0,
        sequence: 167,
        atime: Time {
            sec: 1708913585,
            nsec: 477590212,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 13 00 00 00 00 00 00 00 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 FF A1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A7 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B1 F3 DB 65 00 00 00 00 C4 72 77 1C A4 F3 DB 65 00 00 00 00 44 ED 79 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 44 ED 79 38
3B06Ref (0C)25D["libauparse.so"]3AEC000
name"libauparse.so"
index291
show full value
Ref(
    [
        RefItem {
            index: 291,
            name_len: 13,
            name: "libauparse.so",
        },
    ],
)
show hex data
23 01 00 00 00 00 00 00 0D 00 6C 69 62 61 75 70 61 72 73 65 2E 73 6F
3B06ExtentData (6C)0inline, length 19 B3AEC000
show full value
ExtentData(
    ExtentDataItem {
        header: ExtentDataHeader {
            generation: 9,
            ram_bytes: 19,
            compression: 0,
            encryption: 0,
            other_encoding: 0,
            extent_type: 0,
        },
        data: Inline(
            [
                108,
                105,
                98,
                97,
                117,
                112,
                97,
                114,
                115,
                101,
                46,
                115,
                111,
                46,
                48,
                46,
                48,
                46,
                48,
            ],
        ),
    },
)
show hex data
09 00 00 00 00 00 00 00 13 00 00 00 00 00 00 00 00 00 00 00 00 6C 69 62 61 75 70 61 72 73 65 2E 73 6F 2E 30 2E 30 2E 30
3B07Inode (01)0symbolic link, mode 07773AEC000
size19
mode41471
uid0
gid0
nlink1
atime1708913585
ctime1708913572
mtime1705490454
otime1708913572
show full value
Inode(
    InodeItem {
        generation: 9,
        transid: 10,
        size: 19,
        nbytes: 19,
        block_group: 0,
        nlink: 1,
        uid: 0,
        gid: 0,
        mode: 41471,
        rdev: 0,
        flags: 0,
        sequence: 102,
        atime: Time {
            sec: 1708913585,
            nsec: 477590212,
        },
        ctime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
        mtime: Time {
            sec: 1705490454,
            nsec: 0,
        },
        otime: Time {
            sec: 1708913572,
            nsec: 947514692,
        },
    },
)
show hex data
09 00 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 13 00 00 00 00 00 00 00 13 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 FF A1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B1 F3 DB 65 00 00 00 00 C4 72 77 1C A4 F3 DB 65 00 00 00 00 44 ED 79 38 16 B8 A7 65 00 00 00 00 00 00 00 00 A4 F3 DB 65 00 00 00 00 44 ED 79 38
next
last