AUDIT_SET_PID(3)

🎀 AUDIT_SET_PID — the Linux Audit API, bestie edition 🎀

Okay so real quick, the manual name is AUDIT_SET_PID(3) — it lives in section 3 of the Linux Audit API, and it's about telling the kernel who the audit daemon is. Let's get into it 💅

---

✨ NAME ✨

audit_set_pid — Set audit daemon process ID. That's the whole vibe. One job, does it well 🫶

---

🌸 SYNOPSIS 🌸

#include <libaudit.h>

int audit_set_pid(int fd, uint32_t pid, rep_wait_t wmode);

(Yes, the header is <libaudit.h> — copy it exactly, no autocorrect bestie 😭)

---

💖 DESCRIPTION 💖

So, audit_set_pid tells the kernel what the pid is of the audit daemon. That's it. That's the whole assignment. It's giving "here's my number, kernel, call me" 📞✨

The fd argument is an open descriptor to the audit netlink socket. Like, the actual connection. Don't just pass it some random int, it needs to be a real one 🙈

Now here's the juicy part:

• When pid is set to 0, the kernel will log all events to syslog. Old school. Respect. 📜
• Otherwise, the kernel will try to send events to the netlink connection that has the same pid given by this function. So you're basically pointing the kernel at your socket. Iconic 👑

And lowkey the kernel has your back: if for some reason the process goes away, the kernel will automatically set the value to 0 itself. Built-in cleanup, no cap 🧹✨

Usually this function is called by the audit daemon and not an external program. So if you're out here calling it from some random little side program... not the move bestie 💀 That's the audit daemon's job, let her cook.

One more thing: if wmode is WAIT_YES, the function will wait for an ACK from the kernel. Synchronous behaviour. It'll just sit there, patiently, waiting for the kernel to say "got it" ⏳💖

---

🌈 RETURN VALUE 🌈

The return value is <= 0 on error, otherwise it is the netlink sequence id number. So a positive number = we slayed, a zero-or-negative = we did not slay 😭

Also, this function can have any error that sendto would encounter. Any of them. The whole collection. So don't be surprised if you get something unexpected — it's not a bug, it's just sendto being sendto 💀

---

🦋 SEE ALSO 🦋

• audit_open(3)
• auditd(8)

Go read those too, they're part of the extended universe 🫶

---

🌟 AUTHOR 🌟

Steve Grubb — the author, the moment, the main character 💜

---

Sign-off time bestie ✨ This page came from Red Hat, dated Oct 2006 — vintage, retro, still relevant. Slay forever 💅🎀💖