auditd_reset(9)

Bestie, welcome to auditd_reset(9) from the Kernel API Manual — today's whole vibe is “disconnect the auditd connection,” and we're gonna be so normal about it 💖✨

🌸 NAME 🌸

auditd_reset - Disconnect the auditd connection. Periodt. 💅

✨ SYNOPSIS ✨

void auditd_reset (const struct auditd_connection *ac );

🎀 ARGUMENTS 🎀

• ac — auditd connection state 👑

🦋 DESCRIPTION 🦋

Okay so this function literally breaks the auditd/kauditd connection and moves all the queued records into the hold queue, in case auditd reconnects. It's giving “clean break, but keep the receipts” 🧾✨

🚨 Important note, bestie: the ac pointer should never be dereferenced inside this function as it may be NULL or invalid — you can only compare the memory address! If ac is NULL then the connection will always be reset. No cap. 💀

🌈 SEE ALSO 🌈

Go read these too, iykyk 🫶 — kernel file: ./kernel/audit.c, plus:

• struct audit_net(9)
• struct auditd_connection(9)
• struct audit_ctl_mutex(9)
• auditd_test_task(9)
• audit_ctl_lock(9)
• audit_ctl_unlock(9)
• audit_ctl_owner_current(9)
• auditd_pid_vnr(9)
• audit_cfg_lsm(9)
• audit_get_sk(9)
• audit_log_lost(9)
• auditd_conn_free(9)
• auditd_set(9)
• kauditd_printk_skb(9)
• kauditd_rehold_skb(9)
• kauditd_hold_skb(9)
• kauditd_retry_skb(9)
• auditd_send_unicast_skb(9)
• kauditd_send_queue(9)
• kauditd_thread(9)
• audit_send_reply(9)
• audit_receive(9)
• audit_serial(9)
• audit_log_start(9)
• audit_expand(9)
• audit_log_format(9)
• audit_log_n_hex(9)
• audit_string_contains_control(9)
• audit_log_n_untrustedstring(9)
• audit_log_untrustedstring(9)
• audit_buffer_aux_new(9)
• audit_buffer_aux_end(9)
• audit_log_subj_ctx(9)
• audit_log_path_denied(9)
• audit_set_loginuid(9)
• audit_signal_info(9)
• __audit_log_end(9)
• audit_log_end(9)
• audit_log(9)

Source/version: ./kernel • date: October 2026 • page: auditd_reset(9) — bye bestie, stay iconic! 🫶🎀💖