AUDIT_REQUEST_FEATURES(3)

💖 AUDIT_REQUEST_FEATURES 💖

okay bestie, so this is audit_request_features from the Linux Audit API — it lives in section 3 of the manual, which is the "library functions" section, iykyk. She's a libaudit girlie and she has one job and she does it flawlessly. ✨

🌸 NAME 🌸

audit_request_features — request audit feature bitmap 🎀

Like, literally just ask the kernel "hey queen, what audit features do you support?" and get a bitmap back. That's the whole vibe.

🦋 SYNOPSIS 🦋

#include <libaudit.h>

int audit_request_features(int fd);

Two lines, no drama, no notes. 💅

👑 DESCRIPTION 👑

So here's the tea, bestie 🍓: audit_request_features() requests that the kernel send a structure describing supported audit features on fd.

And fd — listen — must be an open audit netlink socket. Not just any random file descriptor, not your cousin's socket, an audit netlink socket. No cap. If it isn't, that's on you. 🙈

⭐ RETURN VALUE ⭐

• The return value is <= 0 on error — so zero or negative means something went wrong, periodt. 😭
• Otherwise, it's the netlink sequence id number. Iconic. ✨
• And heads up: this function can have any error that sendto(2) would encounter. So if sendto(2) can throw it, this baby can catch it too. Main character energy, honestly.

🌈 SEE ALSO 🌈

• audit_get_features(3)
• audit_open(3)
• auditd(8)

Go read those next, bestie, they're all in the same friend group. 🫶

💜 AUTHOR 💜

Steve Grubb — the legend, the blueprint, the moment. 👑

Red Hat, July 2025 — that's where this page comes from and when she was last updated. Slay, and good luck with your feature bitmap, bestie 💖🎀🦋✨