AUDIT_SET_FAILURE(3)

💖 AUDIT_SET_FAILURE(3) 💖

okay so bestie, this is a page from the Linux Audit API — the AUDIT_SET_FAILURE(3) one — and honestly? it's short, it's sweet, and it's lowkey about what your kernel does when the audit party gets too full. let's get into it 🎀

---

✨ NAME ✨

audit_set_failure — set the audit failure flag. that's it, that's the name, no notes 💅

---

🌸 SYNOPSIS 🌸

#include <libaudit.h>

int audit_set_failure(intfd,uint32_t"failure);"

yes the signature is giving cursed, we don't talk about it, just vibe with it 🫶

---

🦋 DESCRIPTION 🦋

so like, audit_set_failure sets the action that the kernel will perform when the backlog limit is reached — or when it hits an error and literally cannot proceed. it's the "what do we do now bestie" switch. 🔥

the possible values are:

• 0 - AUDIT_FAIL_SILENT — do nothing, report nothing, skip logging the record, and just continue. silence. iconic ghost behaviour 💀
• 1 - AUDIT_FAIL_PRINTK — [default] — log the audit record using printk, which will cause subsequent events to get written to syslog. the responsible one, the main character 👑
• 2 - AUDIT_FAIL_PANIC — call the panic function. this would be used to prevent use of the machine upon loss of audit events. yeah. it panics. on purpose. not me being dramatic, that's literally the spec 😭

okay fr fr, if you pick 2 you are choosing violence on purpose — it's there so the machine stops being usable if audit events get lost. not a casual setting, bestie, that's a whole commitment. 🚨

---

🌈 RETURN VALUE 🌈

the return value is <= 0 on error, otherwise it's the netlink sequence id number. and ngl, this function can have any error that sendto would encounter — so if sendto can be weird about it, so can this. 💜

---

⭐ SEE ALSO ⭐

• audit_set_backlog_limit(3)
• audit_open(3)
• auditd(8)
• auditctl(8)

iykyk, go read those next 🧚

---

🍓 AUTHOR 🍓

Steve Grubb — thank you king 🫶

---

and that's the whole page bestie!! this one came from Red Hat, dated June 2015, so it's a certified classic from the Linux Audit API era. slay, stay audited, and don't set it to panic unless you mean it 💖✨🎀