AUDIT_RESET_LOST(3)

💖 AUDIT_RESET_LOST — Linux Audit API 💖

okay bestie, we're doing audit_reset_lost from the Linux Audit API today and honestly? she's a little legend. sit down, grab a strawberry 🍓, and let's get into it.

✨ NAME ✨

audit_reset_lost — reset lost event counter

like, she resets the lost event counter. that's the whole job. iconic behavior, no notes. 👑

🌸 SYNOPSIS 🌸

#include <libaudit.h>

int audit_reset_lost(int fd);

literally just one function and one include. we love a low-maintenance queen. 💅

🦋 DESCRIPTION 🦋

okay so here's the tea, bestie. audit_reset_lost() resets the kernel's lost event counter, and it does it using the descriptor fd.

and fd? that has to be an open audit netlink socket. not just any random fd you found lying around, no ma'am. it's giving "must be the right socket or this whole vibe is off." 🙈

also — and this is the important part — this call requires that the kernel support AUDIT_FEATURE_BITMAP_LOST_RESET. if the kernel doesn't have that feature? it's simply not happening, and that's the vibe check you gotta pass first. ⭐

🔥 RETURN VALUE 🔥

so the return value is <= 0 on error. yes, less than or equal to zero, that's not a typo, that's the actual rule, don't come for me. 😭

otherwise — meaning when it's not erroring out on you — it's the netlink sequence id number. cute little number, that's your reward for a job well done. 🎀

🌈 SEE ALSO 🌈

• audit_get_features(3)
• audit_open(3)
• auditctl(8)

go read those too, they're all part of the same friend group, iykyk. 💜

👑 AUTHOR 👑

Steve Grubb — periodt. thank you for your service, king. 🫶

and that's the whole page, bestie! every single detail is still here, the facts did not move, only the vibe got upgraded. ✨

🌸 Red Hat · July 2025 🌸

mwah, take care of your netlink sockets and stay slay 💖