AUDIT_SET_RATE_LIMIT(3)

✨ AUDIT_SET_RATE_LIMIT 💖

okay bestie, welcome to the Linux Audit API corner of the manual, where we learn how to make the kernel chill out a lil 💅

---

🎀 NAME 🎀

audit_set_rate_limit — set the audit rate limit 🚦

---

🌸 SYNOPSIS 🌸

#include <libaudit.h>

int audit_set_rate_limit(int fd, uint32_t limit);"

(yes the signature is literally that, we don't question the vibe 🙈)

---

🦋 DESCRIPTION 🦋

so, audit_set_rate_limit will set the maximum number of messages that the kernel will send per second. literally the speed limit but for audit messages, no cap 🚗💨

why would you want that? because it can be used to throttle the rate if systems become unresponsive — like when your box is absolutely drowning in events and being dramatic about it 😭

but bestie, be real with me: of course the trade off is that events will be dropped. you're capping the flow, so some of the messages just… don't make it. periodt 💀

the limit argument controls how many messages may be sent each second.

and the default value is 0, meaning no limit — the kernel goes full main character, unbothered, unlimited ✨

---

🔥 RETURN VALUE 🔥

the return value is <= 0 on error, otherwise it is the netlink sequence id number 👑

also fyi: this function can have any error that sendto would encounter. so whatever chaos sendto is capable of, this one inherits it fr fr.

---

🌈 SEE ALSO 🌈

• audit_open(3)
• auditd(8)

---

👑 AUTHOR 👑

Steve Grubb 💜

---

Red Hat · Oct 2006 · and that's the whole Linux Audit API moment bestie 🫶 slay responsibly, mwah 💋🎀