audit_serial(9)

💖 audit_serial(9) — a Kernel API Manual moment 💖

okay so bestie, welcome to the audit_serial(9) page from the Kernel API Manual. It’s giving kernel-internals realness, and we’re gonna get through it together. ✨

---

🌸 NAME 🌸

audit_serial — compute a serial number for the audit record. That’s the whole name. No cap. 💅

---

✨ SYNOPSIS ✨

The entire synopsis is literally this one line:

unsigned int audit_serial (void );

---

🎀 ARGUMENTS 🎀

• void — no arguments. Zero. None. The function said void and meant it. 🫶

---

🦋 DESCRIPTION 🦋

okay so here’s the vibe: this function computes a serial number for the audit record.

Audit records are written to user-space as soon as they are generated, so a complete audit record may be written in several pieces. User-space tools use the timestamp of the record and this serial number to determine which pieces belong to the same audit record. The (timestamp,serial) tuple is unique for each syscall and is live from syscall entry to syscall exit. Periodt. 🔥

---

💅 NOTE 💅

not me presenting the note exactly as it is: another possibility is to store the formatted records off the audit context (for those records that have a context), and emit them all at syscall exit. However, this could delay the reporting of significant errors until syscall exit (or never, if the system halts). And that last bit is giving danger energy, so don’t gloss over it. 💀

---

🔥 SEE ALSO 🔥

Kernel file ./kernel/audit.c is the main character, and here’s the whole SEE ALSO squad — every single one, because we don’t skip references in this house:

• Kernel file ./kernel/audit.c
• struct audit_net(9)
• struct auditd_connection(9)
• struct audit_ctl_mutex(9)
• auditd_test_task(9)
• audit_ctl_lock(9)
• audit_ctl_unlock(9)
• audit_ctl_owner_current(9)
• auditd_pid_vnr(9)
• audit_cfg_lsm(9)
• audit_get_sk(9)
• audit_log_lost(9)
• auditd_conn_free(9)
• auditd_set(9)
• kauditd_printk_skb(9)
• kauditd_rehold_skb(9)
• kauditd_hold_skb(9)
• kauditd_retry_skb(9)
• auditd_reset(9)
• auditd_send_unicast_skb(9)
• kauditd_send_queue(9)
• kauditd_thread(9)
• audit_send_reply(9)
• audit_receive(9)
• audit_log_start(9)
• audit_expand(9)
• audit_log_format(9)
• audit_log_n_hex(9)
• audit_string_contains_control(9)
• audit_log_n_untrustedstring(9)
• audit_log_untrustedstring(9)
• audit_buffer_aux_new(9)
• audit_buffer_aux_end(9)
• audit_log_subj_ctx(9)
• audit_log_path_denied(9)
• audit_set_loginuid(9)
• audit_signal_info(9)
• __audit_log_end(9)
• audit_log_end(9)
• audit_log(9)

---

okay bye bestie! This page is from source/version ./kernel, dated October 2026. audit_serial(9) out. Mwah. 💋🎀