AUDITCTL(2)

📦 version 12.2, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 AUDITCTL — the auditctl(2) page, bestie edition 💖

okay so. you found the AUDITCTL(2) page in the System Calls Manual and you're like "what is this" — don't worry, I got you. this is a system call, it's in section 2, and it's way less scary than it looks. let's go 🦋

✨ NAME ✨

auditctl — configure system audit parameters

like, it sets up your audit stuff. that's the whole vibe check. 💅

✨ SYNOPSIS ✨

#include <bsm/audit.h>

int
auditctl(const char *path);

ok so you include <bsm/audit.h>, you call auditctl() with a path, and it hands you back an int. iconic signature, no notes. 🎀

✨ DESCRIPTION ✨

so here's the tea: the auditctl() system call tells the kernel to open a brand new audit trail log file. that's its whole job and it does it well. 👑

it requires an appropriate privilege — like, you can't just roll up and do this, you need the permissions, no cap.

and here's the little plot twist bestie: auditctl() opens new files, but if you want to disable the audit log, that's a whole different call — you gotta use auditon(2) for that. different function, different job. don't mix them up. 🙈

✨ RETURN VALUES ✨

  • if everything goes great → you get back the value 0. slay. ✨
  • if it goes bad → you get back the value -1, and the global variable errno gets set to tell you what went wrong. 😭

that's the whole thing. 0 good, -1 not good, errno is your little detective. 🔍

✨ ERRORS ✨

the auditctl() system call will fail if:

  • [EINVAL] — the path is invalid. like, the path you handed over just doesn't work. 💀
  • [EPERM] — the process does not have sufficient permission to complete the operation. you didn't have the privilege, bestie, it happens. 🚫

✨ SEE ALSO ✨

go read these next, they're the friend group:

✨ HISTORY ✨

storytime 🌸 — the OpenBSM implementation was created by McAfee Research, the security division of McAfee Inc., under contract to Apple Computer Inc. in 2004. literally 2004, ancient history in internet years.

and then it got adopted by the TrustedBSD Project as the foundation for the OpenBSM distribution. glow up. 👑

✨ AUTHORS ✨

this software was created by McAfee Research, the security research division of McAfee, Inc., under contract to Apple Computer Inc. 🫶

additional authors include Wayne Salamon, Robert Watson, and SPARTA Inc. — shoutout to the whole crew. 💜

the Basic Security Module (BSM) interface to audit records and audit event stream format were defined by Sun Microsystems. respect where it's due. ⭐

and this manual page was written by Robert Watson <rwatson@FreeBSD.org>. thank you for your service, king. 🎀

and that's the page!! 💖 this came to you from Debian, dated April 19, 2005 — yeah, it's been around a minute, but it still ate. go forth and audit responsibly, bestie. periodt. 💅✨

📦 where this page comes from