audit_set_failure(3) — Linux manual page


AUDIT_SET_FAILURE(3)         Linux Audit API        AUDIT_SET_FAILURE(3)

NAME         top

       audit_set_failure - Set audit failure flag

SYNOPSIS         top

       #include <libaudit.h>

       int audit_set_failure(int fd, uint32_t failure);

DESCRIPTION         top

       audit_set_failure sets the action that the kernel will perform
       when the backlog limit is reached or when it encounters an error
       and cannot proceed. Possible values are:

              Do nothing, report nothing, skip logging the record and

       1 - AUDIT_FAIL_PRINTK [default]
              Log the audit record using printk which will cause
              subsequent events to get written to syslog.

              Call the panic function. This would be used to prevent use
              of the machine upon loss of audit events.

RETURN VALUE         top

       The return value is <= 0 on error, otherwise it is the netlink
       sequence id number. This function can have any error that sendto
       would encounter.

SEE ALSO         top

       audit_set_backlog_limit(3), audit_open(3), auditd(8),

AUTHOR         top

       Steve Grubb

COLOPHON         top

       This page is part of the audit (Linux Audit) project.
       Information about the project can be found at 
       ⟨⟩.  If you have a bug
       report for this manual page, send it to
       This page was obtained from the project's upstream Git repository
       ⟨⟩ on
       2023-12-22.  (At that time, the date of the most recent commit
       that was found in the repository was 2023-11-30.)  If you
       discover any rendering problems in this HTML version of the page,
       or you believe there is a better or more up-to-date source for
       the page, or you have corrections or improvements to the
       information in this COLOPHON (which is not part of the original
       manual page), send a mail to

Red Hat                         June 2015           AUDIT_SET_FAILURE(3)

Pages that refer to this page: audit_set_backlog_limit(3)