AUDIT_LOG_USER_COMM_MESSAGE(3)

💖 AUDIT_LOG_USER_COMM_MESSAGE 💖

okay bestie, welcome to section 3 of the Linux Audit API manual, and today's main character is audit_log_user_comm_message. yes it's a long name. no we're not abbreviating it. it ate and it knows it.

---

✨ NAME ✨

audit_log_user_comm_message — log a user message from a console app 🫶

---

🌸 SYNOPSIS 🌸

#include <libaudit.h>

int audit_log_user_comm_message(int audit_fd,
                                int type,
                                const char *message,
                                const char *comm,
                                const char *hostname,
                                const char *addr,
                                const char *tty,
                                int result);

like. eight arguments. she's high maintenance but she's worth it 💅

---

🦋 DESCRIPTION 🦋

so this function logs a message into the audit system using a predefined message format. it's the one you want if you're a non-ELF console app that does not mess with accounts, does not mess with groups, and doesn't need to log script execution. think a Python script recording an event — that's literally the vibe. 🌈

here's the rundown on every single parameter, no skipping, we don't do that here:

• audit_fd — the fd that audit_open handed you
• type — type of message, e.g. AUDIT_USYS_CONFIG, AUDIT_USER_LOGIN
• message — the message text being sent
• comm — the task command name from /proc/self/comm, or NULL if it's unknown
• hostname — the hostname if known, NULL if unknown
• addr — the network address of the user, NULL if unknown
• tty — the tty of the user; if it's NULL she'll attempt to figure it out herself 🔍
• result — 1 is "success" and 0 is "failed"

⚠️ okay important lore: the kernel task command name is capped at 15 bytes, because TASK_COMM_LEN is 16 bytes including the terminating null byte. so if you pass a non-NULL comm that's longer than 15 bytes, it gets truncated to 15 bytes and a warning gets logged. that's not a suggestion, that's just what happens 😭

---

⭐ RETURN VALUE ⭐

she returns the sequence number — that's > 0 on success, or <= 0 on error. so like, positive = slay, zero-or-below = not slay. 🎀

---

💀 ERRORS 💀

this function returns -1 on failure. go examine errno for more info, bestie, the answers are in there.

---

🔥 SEE ALSO 🔥

• audit_log_user_message(3)
• audit_log_acct_message(3)
• audit_log_user_avc_message(3)
• audit_log_semanage_message(3)

the whole friend group honestly 👑

---

👑 AUTHOR 👑

Steve Grubb

---

and that's the page!! brought to you by Red Hat, dated July 2016 — yes this manual page is a whole adult now and it's still serving. mwah 💖✨🎀