kauditd_send_queue(9)

🎀 NAME 🎀

Okay so bestie, this is the page for kauditd_send_queue from the Kernel API Manual — and it’s literally the helper for kauditd_thread to flush skb queues. 💅✨

🌸 SYNOPSIS 🌸

int kauditd_send_queue (struct sock *sk , u32 portid , struct
       sk_buff_head *queue , unsigned int retry_limit , void (*skb_hook)(struct
       sk_buff *skb) , void (*err_hook)(struct sk_buff *skb, int error) );

🦋 ARGUMENTS 🦋

• sk — the sending sock, aka the socket doing the sending 🫶
• portid — the netlink destination, where it’s headed 💌
• queue — the skb queue to process, the whole lineup to get through 🎀
• retry_limit — limit on number of netlink unicast failures, like the “okay bestie, we tried enough” cap 💀
• skb_hook — per-skb hook for additional processing, a little extra touch per skb ✨
• err_hook — hook called if the skb fails the netlink unicast send, for when it does not slay 😭

💖 DESCRIPTION 💖

Run through the given queue and attempt to send the audit records to auditd — it returns 0 on success and negative values on failure. No cap, that’s the contract. 👑

Big caveat, bestie: it is up to the caller to ensure that sk is valid for the duration of this function. That part is not optional — keep sk alive the whole time this function is running. 🚨

✨ SEE ALSO ✨

Kernel file ./kernel/audit.c, plus the whole squad:

• struct audit_net(9)
• struct auditd_connection(9)
• struct audit_ctl_mutex(9)
• auditd_test_task(9)
• audit_ctl_lock(9)
• audit_ctl_unlock(9)
• audit_ctl_owner_current(9)
• auditd_pid_vnr(9)
• audit_cfg_lsm(9)
• audit_get_sk(9)
• audit_log_lost(9)
• auditd_conn_free(9)
• auditd_set(9)
• kauditd_printk_skb(9)
• kauditd_rehold_skb(9)
• kauditd_hold_skb(9)
• kauditd_retry_skb(9)
• auditd_reset(9)
• auditd_send_unicast_skb(9)
• kauditd_thread(9)
• audit_send_reply(9)
• audit_receive(9)
• audit_serial(9)
• audit_log_start(9)
• audit_expand(9)
• audit_log_format(9)
• audit_log_n_hex(9)
• audit_string_contains_control(9)
• audit_log_n_untrustedstring(9)
• audit_log_untrustedstring(9)
• audit_buffer_aux_new(9)
• audit_buffer_aux_end(9)
• audit_log_subj_ctx(9)
• audit_log_path_denied(9)
• audit_set_loginuid(9)
• audit_signal_info(9)
• __audit_log_end(9)
• audit_log_end(9)
• audit_log(9)

That’s the whole vibe, bestie 💜 — source/version: ./kernel, date: October 2026, and the page is kauditd_send_queue(9). Mwah, go read the kernel code 💋🎀