AUDIT_LOG_ACCT_MESSAGE(3)

💖 AUDIT_LOG_ACCT_MESSAGE 💖

okay bestie, so this is a page from the Linux Audit API — section 3, library functions, iykyk — and it's literally called audit_log_acct_message. Say it with me: audit_log_acct_message. Slay.

---

✨ NAME ✨

audit_log_acct_message — log a user account message 🫶

---

✨ SYNOPSIS ✨

#include <libaudit.h>

int audit_log_acct_message(int audit_fd,
                           int type,
                           const char *pgname,
                           const char *op,
                           const char *name,
                           unsigned int id,
                           const char *host,
                           const char *addr,
                           const char *tty,
                           int result);

---

✨ DESCRIPTION ✨

okay so here's the vibe: this function logs a message to the audit system using a predefined message format. That's it, that's the whole thing. And you should be using it for all your account manipulation operations — like, every single one, no exceptions, periodt. 💅

The function parameters are giving:

• audit_fd — the fd you got back from audit_open. yes, that one. 🎀
• type — the type of message: AUDIT_USER_CHAUTHTOK for changing any account attributes. that's the one it wants here. 🌸
• pgname — the program's name. if you pass NULL it will attempt to figure it out for you. cute of it honestly. 🦋
• op — the operation. like, for real for real: "adding-user", "changing-finger-info", "deleting-group". 👑 and listen — this value should have a dash or underscore between the words so that report parsers group them together. don't be out here writing "adding user" with a space, the parsers will simply not group it and it will be a whole mess. 😭
• name — the user's account or group name. if it's not available, use NULL. no cap. 💜
• id — the uid or gid that the operation is being performed on. if the user is unknown, pass a -1 and fill in the name parameter instead. note bestie: this is used only when user is NULL. 🙈
• host — the hostname if known. if not available, pass a NULL.
• addr — the network address of the user. if not available, pass a NULL.
• tty — the tty of the user. if NULL it will attempt to figure it out. main character behavior honestly. ✨
• result — 1 is "success" and 0 is "failed". binary queen. ⭐

---

✨ RETURN VALUE ✨

It returns the sequence number, which is > 0 on success or <= 0 on error. so like, positive = we ate, non-positive = we did not. 💀

---

✨ ERRORS ✨

This function returns -1 on failure. go examine errno for more info, that's where the tea is. 🍓

---

✨ SEE ALSO ✨

• audit_log_user_message(3)
• audit_log_user_comm_message(3)
• audit_log_user_avc_message(3)
• audit_log_semanage_message(3)

---

✨ AUTHOR ✨

Steve Grubb — the icon, the legend, the moment. 🧚

---

and that's the whole page bestie!! brought to you by Red Hat, dated Nov 2015, and it's a section 3 Linux Audit API moment. go log those account messages responsibly, ily, bye 💖✨🎀