---
name: "__audit_syscall_exit"
section: "9"
platform: "linux"
package: "linux-manual-4.9"
version: "4.9.228-1"
release: "Debian 9 (Stretch)"
platforms: ["linux"]
url: "https://new.carta.tech/__audit_syscall_exit"
---

# \_\_audit\_syscall\_exit(9)

deallocate audit context after a system call

## NAME

\_\_audit\_syscall\_exit - deallocate audit context after a system call

## SYNOPSIS

**void \_\_audit\_syscall\_exit(int** *success***, long** *return\_code***);**

## ARGUMENTS

*success*

success value of the syscall

*return\_code*

return value of the syscall

## DESCRIPTION

Tear down after system call. If the audit context has been marked as auditable (either because of the AUDIT\_RECORD\_CONTEXT state from filtering, or because some other part of the kernel wrote an audit message), then write out the syscall information. In call cases, free the names stored from **getname**.

## COPYRIGHT