AUDIT\_RESET\_LOST(3) Linux Audit API AUDIT\_RESET\_LOST(3)

# [NAME](#NAME)

audit\_reset\_lost - reset lost event counter

# [SYNOPSIS](#SYNOPSIS)

**#include <libaudit.h>**

**int audit\_reset\_lost(int fd);**

# [DESCRIPTION](#DESCRIPTION)

**audit\_reset\_lost**() resets the kernel's lost event counter using the descriptor *fd* which must be an open audit netlink socket. This call requires that the kernel support **AUDIT\_FEATURE\_BITMAP\_LOST\_RESET**.

# [RETURN VALUE](#RETURN_VALUE)

The return value is <= 0 on error, otherwise it is the netlink sequence id number.

# [SEE ALSO](#SEE_ALSO)

[**audit\_get\_features**(3)](/man/os/audit/audit_get_features.3), [**audit\_open**(3)](/man/os/audit/audit_open.3), [**auditctl**(8)](/man/os/audit/auditctl.8).

# [AUTHOR](#AUTHOR)

Steve Grubb

July 2025 Red Hat

---

Document: audit_reset_lost(3) from audit 4.2.1-r3 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace