audit_log_end(9)

💖 audit_log_end(9) 💖

okay bestie, welcome to the Kernel API Manual — this is audit_log_end(9), and it's literally about ending one audit record. iconic. ✨

---

🌸 NAME 🌸

audit_log_end — end one audit record. that's the assignment, no cap. 💅

---

✨ SYNOPSIS ✨

void audit_log_end (struct audit_buffer *ab );

---

🎀 ARGUMENTS 🎀

• ab — the audit_buffer. that's the whole argument, bestie. 🫶

---

🦋 DESCRIPTION 🦋

okay so here's the vibe: we can not do a netlink send inside an irq context, because it blocks — the last arg, flags, is not set to MSG_DONTWAIT. so instead, the audit buffer is placed on a queue, and a kthread is scheduled to remove them from the queue outside the irq context. May be called in any context, fr fr. 🔥

---

🌈 SEE ALSO 🌈

The kernel file is ./kernel/audit.c, and here's the whole see-also crew:

• struct audit_net(9)
• struct auditd_connection(9)
• struct audit_ctl_mutex(9)
• auditd_test_task(9)
• audit_ctl_lock(9)
• audit_ctl_unlock(9)
• audit_ctl_owner_current(9)
• auditd_pid_vnr(9)
• audit_cfg_lsm(9)
• audit_get_sk(9)
• audit_log_lost(9)
• auditd_conn_free(9)
• auditd_set(9)
• kauditd_printk_skb(9)
• kauditd_rehold_skb(9)
• kauditd_hold_skb(9)
• kauditd_retry_skb(9)
• auditd_reset(9)
• auditd_send_unicast_skb(9)
• kauditd_send_queue(9)
• kauditd_thread(9)
• audit_send_reply(9)
• audit_receive(9)
• audit_serial(9)
• audit_log_start(9)
• audit_expand(9)
• audit_log_format(9)
• audit_log_n_hex(9)
• audit_string_contains_control(9)
• audit_log_n_untrustedstring(9)
• audit_log_untrustedstring(9)
• audit_buffer_aux_new(9)
• audit_buffer_aux_end(9)
• audit_log_subj_ctx(9)
• audit_log_path_denied(9)
• audit_set_loginuid(9)
• audit_signal_info(9)
• __audit_log_end(9)
• audit_log(9)

---

mwah 💋 this page was brought to you by the source/version ./kernel, dated October 2026, and it's literally the audit_log_end(9) manual page. 🎀✨