AUDIT\_SET\_PID(3) Linux Audit API AUDIT\_SET\_PID(3)

# [NAME](#NAME)

audit\_set\_pid - Set audit daemon process ID

# [SYNOPSIS](#SYNOPSIS)

```
#include <libaudit.h>
```

```
int audit_set_pid(int fd, uint32_t pid, rep_wait_t wmode);"
```

# [DESCRIPTION](#DESCRIPTION)

audit\_set\_pid tells the kernel what the pid is of the audit daemon. The *fd* argument is an open descriptor to the audit netlink socket. When *pid* is set to 0, the kernel will log all events to syslog. Otherwise it will try to send events to the netlink connection that has the same *pid* given by this function. If for some reason the process goes away, the kernel will automatically set the value to 0 itself. Usually this function is called by the audit daemon and not an external program. If *wmode* is WAIT\_YES, the function will wait for an ACK from the kernel.

# [RETURN VALUE](#RETURN_VALUE)

The return value is &lt;= 0 on error, otherwise it is the netlink sequence id number. This function can have any error that sendto would encounter.

# [SEE ALSO](#SEE_ALSO)

[**audit\_open**(3)](/man/os/audit/audit_open.3), [**auditd**(8)](/man/os/audit/auditd.8).

# [AUTHOR](#AUTHOR)

Steve Grubb

Oct 2006 Red Hat

---

Document: audit_set_pid(3) from audit 4.2.1-r4 (Chainguard OS)
Source: https://github.com/linux-audit/audit-userspace