AUDIT\_CLOSE(3) Linux Audit API AUDIT\_CLOSE(3)

# [NAME](#NAME)

audit\_close - Close the audit netlink socket connection

# [SYNOPSIS](#SYNOPSIS)

```
#include <libaudit.h>
```

```
void audit_close(int fd);
```

# [DESCRIPTION](#DESCRIPTION)

**audit\_close**() closes the NETLINK\_AUDIT socket that communicates with the kernel part of the Linux Audit Subsystem. *fd* must have been returned by [**audit\_open**(3)](/man/os/audit/audit_open.3).

# [RETURN VALUE](#RETURN_VALUE)

None.

# [SEE ALSO](#SEE_ALSO)

[**audit\_open**(3)](/man/os/audit/audit_open.3), [**netlink**(7)](/man/os/audit/netlink.7).

# [AUTHOR](#AUTHOR)

Steve Grubb

Apr 2021 Red Hat

---

Document: audit_close(3) from audit 4.2.1-r2 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace