audit_set_failure \- Set audit failure flag

.B #include <libaudit.h>

.sp

int audit_set_failure(int fd, int failure);

audit_set_failure sets the action that the kernel will perform when the backlog limit is reached or when it encounters an error and cannot proceed. Possible values are:

.TP

Do nothing, report nothing, skip logging the record and continue.

.TP

Log the audit record using printk which will cause subsequent events to get written to syslog.

.TP

Call the panic function. This would be used to prevent use of the machine upon loss of audit events.

The return value is <= 0 on error, otherwise it is the netlink sequence id number. This function can have any error that sendto would encounter.

.BR audit_set_backlog (3),

.BR audit_open (3),

.BR auditd (8),

.BR auditctl (8).

Steve Grubb