AUDIT\_SET\_FAILURE(3) Linux Audit API AUDIT\_SET\_FAILURE(3)

# [NAME](#NAME)

audit\_set\_failure - Set audit failure flag

# [SYNOPSIS](#SYNOPSIS)

**#include <libaudit.h>**

**int audit\_set\_failure(intfd,uint32\_t"failure);"**

# [DESCRIPTION](#DESCRIPTION)

audit\_set\_failure sets the action that the kernel will perform when the backlog limit is reached or when it encounters an error and cannot proceed. Possible values are:

0 - AUDIT\_FAIL\_SILENT

Do nothing, report nothing, skip logging the record and continue.

1 - AUDIT\_FAIL\_PRINTK \[default]

Log the audit record using printk which will cause subsequent events to get written to syslog.

2 - AUDIT\_FAIL\_PANIC

Call the panic function. This would be used to prevent use of the machine upon loss of audit events.

# [RETURN VALUE](#RETURN_VALUE)

The return value is <= 0 on error, otherwise it is the netlink sequence id number. This function can have any error that sendto would encounter.

# [SEE ALSO](#SEE_ALSO)

[**audit\_set\_backlog\_limit**(3)](/man/os/audit/audit_set_backlog_limit.3), [**audit\_open**(3)](/man/os/audit/audit_open.3), [**auditd**(8)](/man/os/audit/auditd.8), [**auditctl**(8)](/man/os/audit/auditctl.8).

# [AUTHOR](#AUTHOR)

Steve Grubb

June 2015 Red Hat

---

Document: audit_set_failure(3) from audit 4.2.1-r3 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace