AUDIT_OPEN(3)

💖 AUDIT_OPEN(3) 💖

ok so bestie, we're in the Linux Audit API section of the manual and today's main character is audit_open. it's giving "tiny function, big responsibility" ngl 🫶

---

✨ NAME ✨

audit_open — open an audit netlink socket connection 🌸

---

✨ SYNOPSIS ✨

#include <libaudit.h>

int audit_open(void);

like, that's it. no args. no drama. just vibes 💅

---

✨ DESCRIPTION ✨

so what this icon does is create a NETLINK_AUDIT socket, and that socket is your little phone line to the kernel part of the Linux Audit Subsystem 📞✨ it's literally how you talk to it.

and here's the tea: the audit system uses the ACK feature of netlink. which means every single message you send to the kernel comes back with a netlink status packet — even when the operation succeeds 🎀 so don't be out here waiting for a reply only when things go wrong, bestie, you're getting one either way. periodt.

---

✨ RETURN VALUE ✨

• returns -1 if an error occurs 😭
• otherwise the return value is a descriptor referencing the socket — that's your new bestie, hold onto it 🫶

---

✨ ERRORS ✨

the audit_open() function may fail and set errno for any of the errors specified for the socket(2) and fcntl(2) routines 🔥

so if it acts up, go read those two man pages, that's where the receipts are, iykyk 💜

---

✨ SEE ALSO ✨

• netlink(7)

---

✨ AUTHOR ✨

Steve Grubb 👑

---

and that's the whole page, bestie, you ate it up 💅✨ this was brought to you by Red Hat, dated Oct 2006, and it lives in the AUDIT_OPEN(3) section forever and ever 🎀🦋 ngl a 2006 legend still carrying the audit subsystem on its back. obsessed. 🌈💖