AUDIT\_DELETE\_RULE\_DATA(3) Linux Audit API AUDIT\_DELETE\_RULE\_DATA(3)

# [NAME](#NAME)

audit\_delete\_rule\_data - Delete audit rule

# [SYNOPSIS](#SYNOPSIS)

```
#include <libaudit.h>
```

```
int audit_delete_rule_data(int fd, struct audit_rule_data *rule, int flags, int action);"
```

# [DESCRIPTION](#DESCRIPTION)

audit\_delete\_rule\_data is used to delete rules that are currently loaded in the kernel. The file descriptor is given in *fd* and the rule description in *rule*. To delete a rule, you must set up the rules identical to the one being deleted. See audit\_add\_rule\_data for *flags* and *action* definitions.

# [RETURN VALUE](#RETURN_VALUE)

The return value is &lt;= 0 on error, otherwise it is the netlink sequence id number. This function can have any error that sendto would encounter.

# [SEE ALSO](#SEE_ALSO)

[**audit\_add\_rule\_data**(3)](/man/os/audit/audit_add_rule_data.3), [**auditctl**(8)](/man/os/audit/auditctl.8).

# [AUTHOR](#AUTHOR)

Steve Grubb

Oct 2006 Red Hat

---

Document: audit_delete_rule_data(3) from audit 4.2.1-r3 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace