AUDIT_SET_BACKLOG_WAIT_TIME(3)

💖 AUDIT_SET_BACKLOG_WAIT_TIME — bestie edition 💖

soooo this is a page from the Library Functions Manual, and the function it's hyping up is audit_set_backlog_wait_time — yes the title gets truncated to AUDIT_SET_...G_WAIT_TIME(3) up top because man page headers have zero chill about column width. anyway. let's get into it 🫶

---

✨ NAME ✨

audit_set_backlog_wait_time — set the audit backlog wait time 💅

---

🌸 SYNOPSIS 🌸

#include <libaudit.h>

int audit_set_backlog_wait_time(int fd, uint32_t bwt);"

okay yes the trailing " is just. there. in the original. we don't question it, we respect it 🙈

---

🦋 DESCRIPTION 🦋

okay so listen. audit_set_backlog_wait_time sets the amount of time the kernel is gonna wait before it tries to yeet more audit events down the descriptor you handed it in fd.

and the bwt parameter? that's your delay, measured in jiffies, before the kernel attempts to transfer more events once backlog_limit has been reached. it's literally giving the audit daemon a lil breather so it can drain the kernel queue 😌✨

and if you're wondering what the default is: it's 60000, aka 60 * HZ, as set in the kernel. iconic. no notes. 👑

---

💜 RETURN VALUE 💜

so the return value is <= 0 on error, otherwise it's the netlink sequence id number. slay.

also heads up bestie — this function can have any error that sendto would encounter. so like, it's not picky. it'll catch whatever sendto catches. 💀

---

🎀 SEE ALSO 🎀

• audit_set_backlog_limit(3)
• audit_open(3)
• auditd(8)
• auditctl(8)

---

👑 AUTHOR 👑

Steve Grubb — the main character who wrote this. periodt. 💖

---

and that's the whole page babes, brought to you by the Linux Audit API, dated Oct 2014. go forth and set your backlog wait times responsibly, ily, bye 🧚✨