AUDISP-AF_UNIX(8)

💖 AUDISP-AF_UNIX(8) — the af_unix plugin, bestie edition 💖

okay so listen, this is audisp-af_unix from the System Administration Utilities girlies, and she is literally the plug (pun fully intended 🫶) that pushes your audit events out to an af_unix socket so other apps can just… read them. no cap. let's get into it ✨

---

🌸 NAME 🌸

audisp-af_unix — a plugin that pushes audit events to an af_unix socket. she delivers. 💅

---

🎀 SYNOPSIS 🎀

audisp-af_unix [ OPTIONS ]

---

✨ DESCRIPTION ✨

okay so audisp-af_unix is a plugin for the audit event dispatcher, and what she does is send audit events to an af_unix socket where other applications can read them. very generous of her, honestly. main character energy. 👑

now here's the tea: the args line of the af_unix.conf file expects three arguments:

1. access mode
2. socket path
3. output format

…and optionally a fourth one for the queue depth. slay.

let's break each one down because i love a structured breakdown:

• access mode — this one decides the permissions for the socket, and it defaults to 0640. she has boundaries, as she should. 🚧
• socket path — this is where the socket is gonna be created, and the default location is /run/audit/audispd_events. iconic address fr fr. 📍
• output format — this decides the format that events get delivered to the socket in, and she supports two options: "string" and "binary".
  • "string" delivers events in a human-readable form 🦋
  • "binary" delivers events in their binary representation, which is essential for applications that need to process events in binary and reconstruct headers accurately. like, no binary, no accurate headers, that's just how it is bestie 😭
• if the output format isn't specified, the plugin defaults to "string".
• if no queue depth is specified, it defaults to 512.

---

🧚 the format = binary line, iykyk 🧚

the af_unix.conf file must also include the line:

format = binary

this setting specifies the input format that the audisp-af_unix plugin expects from the audit event dispatcher. basically it makes sure that the input delivered to the plugin is in binary format, which is what lets the plugin reconstruct headers in their proper binary structure. it's giving prerequisites, and honestly? valid. 🌟

---

💀 SIGUSR1 behavior 💀

when the plugin gets sent SIGUSR1, she writes a state report to af_unix.state. not me romanticizing a signal handler but here we are. 💖

---

🍓 FILES 🍓

these are the girlies she keeps in her life:

• /etc/audit/plugins/af_unix.conf
• /run/audit/audispd_events
• /run/audit/af_unix.state
• /etc/audit/auditd.conf

---

🌈 SEE ALSO 🌈

• auditd.conf(8)
• auditd-plugins(5)

go read them, bestie, they're part of the lore. 📚

---

👑 AUTHOR 👑

Steve Grubb — the author. we stan. 💜

---

ok that's the whole page, you're so welcome, go forth and read your audit events off that socket like the icon you are. 🎀

and that's a wrap from the Red Hat girlies, Aug 2025 edition — mwah, take care of her 💖🦋✨