get_auditfail_action(3) [debian man page]

GET_AUDITFAIL_ACTION(3) 				     Linux Programmer's Manual					   GET_AUDITFAIL_ACTION(3)

NAME

       get_auditfail_action - Get failure_action tunable value

SYNOPSIS

       #include <libaudit.h>

       int get_auditfail_action (int *failmode);

DESCRIPTION

       This function gets the failure_action tunable value stored in /etc/libaudit.conf. get_auditfail_action should be called after an audit_open
       call returns an error to see what action the admin prefers.

       The failure_action value found in /etc/libaudit.conf is copied into the failmode argument upon function return.	This value should then	be
       used by the calling application to determine what action should be taken when the audit subsystem is unavailable.

RETURN VALUE

       Upon  success,  get_auditfail_action returns a zero, and the failmode argument will hold the failure_action value.  The possible values for
       failure_action are: FAIL_IGNORE (0), FAIL_LOG (1), and FAIL_TERMINATE (2). Upon failure, get_auditfail_action returns a return code of one.

ERRORS

       An error is returned if there is an error reading /etc/libaudit.conf or if the failure_action tunable is not found in the file.

EXAMPLES

	      /* Sample code */
	      auditfail_t failmode;

	      if ((fd = audit_open() ) < 0 ) {
		   fprintf (stderr, "Cannot open netlink audit socket");

		   /* Get the failure_action */
		   if ((rc = get_auditfail_action(&failmode)) == 0) {
		       if (failmode == FAIL_LOG)
			    fprintf (stderr, "Audit subsystem unavailable");
		       else if (failmode == FAIL_TERMINATE)
			    exit (1);
		       /* If failmode == FAIL_IGNORE, do nothing */
		   }
	      }

SEE ALSO

       audit_open(3), auditd(8).

AUTHOR

       Lisa M. Smith.

Linux 2.7							     2006-7-10						   GET_AUDITFAIL_ACTION(3)

Check Out this Related Man Page

AUDIT_SET_FAILURE(3)						  Linux Audit API					      AUDIT_SET_FAILURE(3)

NAME

       audit_set_failure - Set audit failure flag

SYNOPSIS

       #include <libaudit.h>

       int audit_set_failure (int fd, int failure);

DESCRIPTION

       audit_set_failure  sets the action that the kernel will perform when the backlog limit is reached or when it encounters an error and cannot
       proceed. Possible values are:

       0 - AUDIT_FAIL_PRINTK [default]
	      Log the audit record using printk which will cause subsequent events to get written to syslog.

       1 - AUDIT_FAIL_SILENT
	      Do nothing, report nothing, skip logging the record and continue.

       2 - AUDIT_FAIL_PANIC
	      Call the panic function. This would be used to prevent use of the machine upon loss of audit events.

RETURN VALUE

       The return value is <= 0 on error, otherwise it is the netlink sequence id number. This function can  have  any	error  that  sendto  would
       encounter.

SEE ALSO

       audit_set_backlog(3), audit_open(3), auditd(8), auditctl(8).

AUTHOR

       Steve Grubb

Red Hat 							     Oct 2006						      AUDIT_SET_FAILURE(3)

Linux and UNIX Man Pages

get_auditfail_action(3) [debian man page]

Check Out this Related Man Page