AUDIT\_LOG\_USER\_COMM\_MESSAGE(3) Linux Audit API AUDIT\_LOG\_USER\_COMM\_MESSAGE(3)

# [NAME](#NAME)

audit\_log\_user\_comm\_message - log a user message from a console app

# [SYNOPSIS](#SYNOPSIS)

```
#include <libaudit.h>
```

```
int audit_log_user_comm_message(int audit_fd,
                                int type,
                                const char *message,
                                const char *comm,
                                const char *hostname,
                                const char *addr,
                                const char *tty,
                                int result);
```

# [DESCRIPTION](#DESCRIPTION)

This function will log a message to the audit system using a predefined message format. This function should be used by all non-ELF console apps that do not manipulate accounts, groups, or need to log execution of a script. An example would be a Python script recording an event. The function parameters are as follows:

```
audit_fd - The fd returned by audit_open
type - type of message, ex: AUDIT_USYS_CONFIG, AUDIT_USER_LOGIN
message - the message text being sent
comm - the task command name from /proc/self/comm, NULL if unknown
hostname - the hostname if known, NULL if unknown
addr - The network address of the user, NULL if unknown
tty - The tty of the user, if NULL will attempt to figure out
result - 1 is "success" and 0 is "failed"
```

The kernel task command name is limited to 15 bytes because **TASK\_COMM\_LEN** is 16 bytes including the terminating null byte. A non-NULL *comm* value longer than 15 bytes is truncated to 15 bytes and a warning is logged.

# [RETURN VALUE](#RETURN_VALUE)

It returns the sequence number which is &gt; 0 on success or &lt;= 0 on error.

# [ERRORS](#ERRORS)

This function returns -1 on failure. Examine errno for more info.

# [SEE ALSO](#SEE_ALSO)

[**audit\_log\_user\_message**(3)](/man/os/audit/audit_log_user_message.3), [**audit\_log\_acct\_message**(3)](/man/os/audit/audit_log_acct_message.3), [**audit\_log\_user\_avc\_message**(3)](/man/os/audit/audit_log_user_avc_message.3), [**audit\_log\_semanage\_message**(3)](/man/os/audit/audit_log_semanage_message.3).

# [AUTHOR](#AUTHOR)

Steve Grubb

July 2016 Red Hat

---

Document: audit_log_user_comm_message(3) from audit 4.2.1-r1 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace