audit_log_lost(9)

✨ NAME ✨

Bestie, welcome to audit_log_lost(9) from the Kernel API Manual — the page that is literally here to conditionally log lost audit message event. 🫶

🌸 SYNOPSIS 🌸

void audit_log_lost (const char *message );

🎀 ARGUMENTS 🎀

• message — the message stating reason for lost audit message. 👀

💖 DESCRIPTION 💖

Okay so here's the tea: emit at least 1 message per second, even if audit_rate_check is throttling. Always increment the lost messages counter. That's the whole move — lowkey simple, highkey important, fr fr. 💅

🦋 SEE ALSO 🦋

Kernel file ./kernel/audit.c is the home base, and the whole squad is: struct audit_net(9), struct auditd_connection(9), struct audit_ctl_mutex(9), auditd_test_task(9), audit_ctl_lock(9), audit_ctl_unlock(9), audit_ctl_owner_current(9), auditd_pid_vnr(9), audit_cfg_lsm(9), audit_get_sk(9), auditd_conn_free(9), auditd_set(9), kauditd_printk_skb(9), kauditd_rehold_skb(9), kauditd_hold_skb(9), kauditd_retry_skb(9), auditd_reset(9), auditd_send_unicast_skb(9), kauditd_send_queue(9), kauditd_thread(9), audit_send_reply(9), audit_receive(9), audit_serial(9), audit_log_start(9), audit_expand(9), audit_log_format(9), audit_log_n_hex(9), audit_string_contains_control(9), audit_log_n_untrustedstring(9), audit_log_untrustedstring(9), audit_buffer_aux_new(9), audit_buffer_aux_end(9), audit_log_subj_ctx(9), audit_log_path_denied(9), audit_set_loginuid(9), audit_signal_info(9), __audit_log_end(9), audit_log_end(9), audit_log(9). 🫶

Ngl, that's a lot of friends, but every single one made the list. iykyk. 💜

Signed with ./kernel energy, October 2026 — audit_log_lost(9) 💖✨