AUDIT\_GET\_REPLY(3) Linux Audit API AUDIT\_GET\_REPLY(3)

# [NAME](#NAME)

audit\_get\_reply - Get the audit system's reply

# [SYNOPSIS](#SYNOPSIS)

```
#include <libaudit.h>
```

```
int audit_get_reply(int fd, struct audit_reply *rep, reply_t block, int peek);"
```

# [DESCRIPTION](#DESCRIPTION)

This function gets the next data packet sent on the audit netlink socket. This function is usually called after sending a command to the audit system. *fd* should be an open file descriptor returned by audit\_open. *rep* should be a data structure to put the reply in. *block* is of type reply\_t which is either: GET\_REPLY\_BLOCKING and GET\_REPLY\_NONBLOCKING. *peek*, if non-zero, gets the data without dequeueing it from the netlink socket.

# [RETURN VALUE](#RETURN_VALUE)

This function returns -errno on error, 0 if error response received, and positive value on success.

# [SEE ALSO](#SEE_ALSO)

[**audit\_open**(3)](/man/os/audit/audit_open.3).

# [AUTHOR](#AUTHOR)

Steve Grubb

Oct 2006 Red Hat

---

Document: audit_get_reply(3) from audit 4.2.1-r2 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace