---
name: "audisp-af_unix"
section: "8"
platform: "linux"
package: "audispd-plugins"
version: "4.2.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/audisp-af_unix"
---

# audisp-af\_unix(8)

plugin to push audit events to an af\_unix socket

## NAME

audisp-af\_unix - plugin to push audit events to an af\_unix socket

## SYNOPSIS

**audisp-af\_unix** \[ *OPTIONS* \]

## DESCRIPTION

**audisp-af\_unix** is a plugin for the audit event dispatcher that sends audit events to an af\_unix socket where other applications can read events. The **args** line of the  **af\_unix.conf** file expects three arguments: access mode, socket path, and output format, and optionally a fourth argument specifying the queue depth. The access mode determines the permissions for the socket and defaults to 0640. The socket path specifies where the socket will be created, with the default location being /run/audit/audispd\_events. The output format determines the format in which events are delivered to the socket and supports two options: "string" and "binary". The "string" format delivers events in a human-readable form, while the "binary" format delivers events in their binary representation, which is essential for applications that need to process events in binary and reconstruct headers accurately. If the output format is not specified, the plugin defaults to the "string" format. If no queue depth is specified, it defaults to 512.

The **af\_unix.conf** file must also include the line **format = binary**. This setting specifies the input format that the **audisp-af\_unix** plugin expects from the audit event dispatcher. It ensures that the input delivered to the plugin is in binary format, enabling the plugin to reconstruct headers in their proper binary structure.

When the plugin is sent **SIGUSR1**, it writes a state report to **af\_unix.state**.

## FILES

/etc/audit/plugins/af\_unix.conf /run/audit/audispd\_events /run/audit/af\_unix.state /etc/audit/auditd.conf

## SEE ALSO

**auditd.conf**(8), [**auditd-plugins**(5)](/auditd-plugins/5.md).

## AUTHOR

Steve Grubb