AUDIT\_GET\_FEATURES(3) Linux Audit API AUDIT\_GET\_FEATURES(3)

# [NAME](#NAME)

audit\_get\_features, audit\_set\_feature - query or change kernel audit features

# [SYNOPSIS](#SYNOPSIS)

**#include <libaudit.h>**

**uint32\_t audit\_get\_features(void);**  
**int audit\_set\_feature(int fd, unsigned feature, unsigned value, unsigned lock);"**

# [DESCRIPTION](#DESCRIPTION)

**audit\_get\_features**() returns a bitmap describing which kernel audit features are supported. The bitmap is cached internally and retrieved from the kernel on the first call.

**audit\_set\_feature**() changes a feature bit for the kernel using the descriptor *fd* which must be an open audit netlink socket. *feature* selects the bit to modify. If *value* is nonzero the feature is enabled, otherwise it is disabled. If *lock* is nonzero the feature setting is locked until reboot.

The feature bits currently defined are:

[**AUDIT\_FEATURE\_BITMAP\_BACKLOG\_LIMIT**](#AUDIT_FEATURE_BITMAP_BACKLOG_LIMIT)

Kernel supports changing the backlog queue depth.

[**AUDIT\_FEATURE\_BITMAP\_BACKLOG\_WAIT\_TIME**](#AUDIT_FEATURE_BITMAP_BACKLOG_WAIT_TIME)

Kernel supports delaying syscalls when the queue is full.

[**AUDIT\_FEATURE\_BITMAP\_EXECUTABLE\_PATH**](#AUDIT_FEATURE_BITMAP_EXECUTABLE_PATH)

Kernel will include the executable path on EXECVE records.

[**AUDIT\_FEATURE\_BITMAP\_EXCLUDE\_EXTEND**](#AUDIT_FEATURE_BITMAP_EXCLUDE_EXTEND)

Exclude rules may be used with more fields than just message type.

[**AUDIT\_FEATURE\_BITMAP\_SESSIONID\_FILTER**](#AUDIT_FEATURE_BITMAP_SESSIONID_FILTER)

Session identifier filtering is supported.

[**AUDIT\_FEATURE\_BITMAP\_LOST\_RESET**](#AUDIT_FEATURE_BITMAP_LOST_RESET)

Allows resetting the lost event counter.

[**AUDIT\_FEATURE\_BITMAP\_FILTER\_FS**](#AUDIT_FEATURE_BITMAP_FILTER_FS)

Kernel supports file system field filtering.

# [RETURN VALUE](#RETURN_VALUE)

**audit\_get\_features** returns the feature bitmap or 0 if feature queries are unsupported. **audit\_set\_feature** returns <= 0 on error, otherwise it is the netlink sequence id number.

# [SEE ALSO](#SEE_ALSO)

[**audit\_request\_features**(3)](/man/os/audit/audit_request_features.3), [**audit\_reset\_lost**(3)](/man/os/audit/audit_reset_lost.3), [**audit\_open**(3)](/man/os/audit/audit_open.3).

# [AUTHOR](#AUTHOR)

Steve Grubb

July 2025 Red Hat

---

Document: audit_get_features(3) from audit 4.2.1-r3 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace