AUDIT_GET_REPLY(3)

💖 AUDIT_GET_REPLY(3) 💖

okay bestie, gather round, because we're talking about audit_get_reply — yes that's the whole name, she's the Linux Audit API's little messenger girl and she's serving 🎀

---

✨ NAME ✨

audit_get_reply — get the audit system's reply 🫶

---

🌸 SYNOPSIS 🌸

#include <libaudit.h>

int audit_get_reply(int fd, struct audit_reply *rep, reply_t block, int peek);"

(and yes, that quote mark at the end is just sitting there being iconic, we don't question her 💅)

---

🦋 DESCRIPTION 🦋

so like. this function grabs the next data packet that comes flying in on the audit netlink socket. it's the move you pull right after you've sent a command off to the audit system — you send, she replies, you catch it. main character energy fr fr ✨

let's break down the girlies:

• fd — gotta be an open file descriptor, the kind you got back from audit_open. no random fd's allowed, she's picky 💅
• rep — a data structure where the reply gets tucked in all cozy 🎀
• block — type reply_t, and it's lowkey a vibe check between two options: GET_REPLY_BLOCKING and GET_REPLY_NONBLOCKING. pick your fighter 🥊
• peek — if this is non-zero, you get the data without dequeueing it from the netlink socket. like looking at your notifications without opening them. obsessed 👀

ngl bestie, peek is the sneaky one — same data, but it stays in the socket's queue, no cap.

---

⭐ RETURN VALUE ⭐

here's the tea, and it's three whole moods:

• -errno — it went wrong 😭 that's a negative errno, so pay attention to the sign
• 0 — an error response was received 💀 (yes, zero is not "all good" here, don't get played)
• positive value — slay, success, we ate 🔥

---

🌈 SEE ALSO 🌈

audit_open(3) — the bestie that hands you the fd in the first place 🫶

---

👑 AUTHOR 👑

Steve Grubb 💜

---

and that's the whole page, bestie!! this one's from Red Hat, dated Oct 2006 — an absolute vintage icon, we stan a classic 💖✨🎀🦋🌸💅🫶🌈⭐👑