GET\_AUDITFAIL\_ACTION(3) Linux Programmer's Manual GET\_AUDITFAIL\_ACTION(3)

# [NAME](#NAME)

get\_auditfail\_action - Get failure\_action tunable value

# [SYNOPSIS](#SYNOPSIS)

```
#include <libaudit.h>
```

```
int get_auditfail_action(auditfail_t *failmode);
```

# [DESCRIPTION](#DESCRIPTION)

This function gets the failure\_action tunable value stored in **/etc/libaudit.conf**. **get\_auditfail\_action** should be called after an **audit\_open** call returns an error to see what action the admin prefers.

The failure\_action value found in **/etc/libaudit.conf** is copied into the *failmode* argument upon function return. This value should then be used by the calling application to determine what action should be taken when the audit subsystem is unavailable.

# [RETURN VALUE](#RETURN_VALUE)

Upon success, **get\_auditfail\_action** returns a zero, and the *failmode* argument will hold the failure\_action value. The possible values for failure\_action are: FAIL\_IGNORE (0), [FAIL\_LOG (1)](/man/os/audit/FAIL_LOG.1), and [FAIL\_TERMINATE (2)](/man/os/audit/FAIL_TERMINATE.2). Upon failure, **get\_auditfail\_action** returns a return code of one.

# [ERRORS](#ERRORS)

An error is returned if there is an error reading **/etc/libaudit.conf** or if the failure\_action tunable is not found in the file.

# [EXAMPLES](#EXAMPLES)

/* Sample code \*/  
auditfail\_t failmode;

if ((fd = audit\_open() ) &lt; 0 ) {  
fprintf (stderr, "Cannot open netlink audit socket");

/* Get the failure\_action \*/  
if ((rc = get\_auditfail\_action(&failmode)) == 0) {  
if (failmode == FAIL\_LOG)  
fprintf (stderr, "Audit subsystem unavailable");  
else if (failmode == FAIL\_TERMINATE)  
[exit (1)](/man/os/audit/exit.1);  
/* If failmode == FAIL\_IGNORE, do nothing \*/  
}  
}

# [SEE ALSO](#SEE_ALSO)

[**audit\_open**(3)](/man/os/audit/audit_open.3), [**auditd**(8)](/man/os/audit/auditd.8).

# [AUTHOR](#AUTHOR)

Lisa M. Smith.

2006-7-10 Linux 2.7

---

Document: get_auditfail_action(3) from audit 4.2.1-r1 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace