AUDIT_SET_BACKLOG_LIMIT(3) AUDIT_SET_BACKLOG_LIMIT(3)

NAME audit_set_backlog_limit - Set the audit backlog limit

SYNOPSIS #include <libaudit.h>

int audit_set_backlog_limit (int fd, int limit);

DESCRIPTION audit_set_backlog_limit sets the queue length for audit events awaiting transfer to the audit daemon. The default value is 64 which can poten- tially be overrun by bursts of activity. When the backlog limit is reached, the kernel consults the failure_flag to see what action to take.

RETURN VALUE The return value is <= 0 on error, otherwise it is the netlink sequence id number. This function can have any error that sendto would encounter.

SEE ALSO audit_set_failure(3), audit_open(3), auditd(8), auditctl(8).

AUTHOR Steve Grubb

Linux Audit API Oct 2006 AUDIT_SET_BACKLOG_LIMIT(3)