audit_log(9)

💖 audit_log(9) 💖

okay so bestie, welcome to the Kernel API Manual — yes we're in the kernel today, we're doing kernel things, and honestly? it's giving main character energy ✨. This little icon is audit_log, and it's about to be your new fave, no cap.

---

🌸 NAME 🌸

audit_log — Log an audit record 🫶

like, that's the whole vibe. you write an audit record. that's it. that's the function.

---

✨ SYNOPSIS ✨

void audit_log (struct audit_context *ctx , gfp_t gfp_mask , int type ,
       const char *fmt , ... );

look at her. so compact. so iconic. 💅 keep those spaces around the commas exactly as they are, iykyk — we don't touch the synopsis, we respect the synopsis.

---

🎀 ARGUMENTS 🎀

okay so let's meet the cast:

• ctx — the audit context. that's your backstage pass, the whole situation lives in here.
• gfp_mask — the type of allocation. yes we're allocating, yes it matters, keep reading bestie.
• type — the audit message type. this is literally the label on the box 📦.
• fmt — the format string to use. classic printf behaviour, you know her.
• ... — the variable parameters matching the format string. one per placeholder, matching fmt, no funny business 🙈.

---

💜 DESCRIPTION 💜

so here's the tea ☕ — audit_log is a convenience function. that's the whole flex. it's a shortcut that calls three other functions for you so you don't have to:

• audit_log_start
• audit_log_vformat
• audit_log_end

three icons, one call. ate and left no crumbs 👑

and the best part? it may be called in any context. any. context. no restrictions, no caveats, no "only from process context" nonsense. she's flexible like that 🌈.

---

🦋 SEE ALSO 🦋

okay so this list is LONG and I'm obsessed with it. all of these live in the kernel file ./kernel/audit.c, and every single one of them is here for you:

struct audit_net(9), struct auditd_connection(9), struct audit_ctl_mutex(9), auditd_test_task(9), audit_ctl_lock(9), audit_ctl_unlock(9), audit_ctl_owner_current(9), auditd_pid_vnr(9), audit_cfg_lsm(9), audit_get_sk(9), audit_log_lost(9), auditd_conn_free(9), auditd_set(9), kauditd_printk_skb(9), kauditd_rehold_skb(9), kauditd_hold_skb(9), kauditd_retry_skb(9), auditd_reset(9), auditd_send_unicast_skb(9), kauditd_send_queue(9), kauditd_thread(9), audit_send_reply(9), audit_receive(9), audit_serial(9), audit_log_start(9), audit_expand(9), audit_log_format(9), audit_log_n_hex(9), audit_string_contains_control(9), audit_log_n_untrustedstring(9), audit_log_untrustedstring(9), audit_buffer_aux_new(9), audit_buffer_aux_end(9), audit_log_subj_ctx(9), audit_log_path_denied(9), audit_set_loginuid(9), audit_signal_info(9), __audit_log_end(9), audit_log_end(9)

forty-one of them. I counted. and yes, audit_log_start and audit_log_end are both in there — the ones from the DESCRIPTION — because the kernel loves a callback to its own lore 💀. go read them. all of them. that's the assignment 📚.

ngl that's a lot of cross-references, but they're all siblings from the same file, so it's less "homework" and more "meeting the whole family" 🫶

---

anyway bestie, that's the page! this cutie comes from the source ./kernel and she's dated October 2026 — so yes, she's fresh, she's current, she's from the future, we love a timeless queen ⭐. hope you had fun, mwah 💋🧚‍♀️