audit_log_start(9)

💖 audit_log_start(9) 💖

okay bestie, welcome to the Kernel API Manual ✨ we're doing audit_log_start(9) today and honestly? it's kind of a big deal in the audit world.

---

🌸 NAME 🌸

audit_log_start — obtain an audit buffer 🎀

---

✨ SYNOPSIS ✨

struct audit_buffer * audit_log_start (struct audit_context *ctx , gfp_t
gfp_mask , int type );

---

🦋 ARGUMENTS 🦋

• ctx — the audit_context (and yes, it may be NULL, no cap)
• gfp_mask — type of allocation
• type — audit message type

---

💅 DESCRIPTION 💅

So what does it do? It returns an audit_buffer pointer on success, or NULL on error. that's the vibe check 💀

Obtain an audit buffer. This routine does locking to obtain the audit buffer, but then no locking is required for calls to audit_log_*format — literally, the lock situation is handled, you're free after that, slay 👑

heads up bestie: if the task (ctx) is a task that is currently in a syscall, then the syscall is marked as auditable and an audit record will be written at syscall exit. 🫶

And if there is no associated task, then task context (ctx) should be NULL. periodt. ✨

---

🔥 SEE ALSO 🔥

Kernel file ./kernel/audit.c — plus the whole friend group, iykyk:

• struct audit_net(9)
• struct auditd_connection(9)
• struct audit_ctl_mutex(9)
• auditd_test_task(9)
• audit_ctl_lock(9)
• audit_ctl_unlock(9)
• audit_ctl_owner_current(9)
• auditd_pid_vnr(9)
• audit_cfg_lsm(9)
• audit_get_sk(9)
• audit_log_lost(9)
• auditd_conn_free(9)
• auditd_set(9)
• kauditd_printk_skb(9)
• kauditd_rehold_skb(9)
• kauditd_hold_skb(9)
• kauditd_retry_skb(9)
• auditd_reset(9)
• auditd_send_unicast_skb(9)
• kauditd_send_queue(9)
• kauditd_thread(9)
• audit_send_reply(9)
• audit_receive(9)
• audit_serial(9)
• audit_expand(9)
• audit_log_format(9)
• audit_log_n_hex(9)
• audit_string_contains_control(9)
• audit_log_n_untrustedstring(9)
• audit_log_untrustedstring(9)
• audit_buffer_aux_new(9)
• audit_buffer_aux_end(9)
• audit_log_subj_ctx(9)
• audit_log_path_denied(9)
• audit_set_loginuid(9)
• audit_signal_info(9)
• __audit_log_end(9)
• audit_log_end(9)
• audit_log(9)

---

okay that's the whole page bestie, go forth and audit 🧚💜

source/version: ./kernel · date: October 2026 — mwah, catch u in the next manpage 💋✨