---
name: "audit_delete_rule_data"
section: "3"
platform: "linux"
package: "audit"
version: "4.2.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/audit_delete_rule_data"
---

# audit\_delete\_rule\_data(3)

Delete audit rule

## NAME

audit\_delete\_rule\_data - Delete audit rule

## SYNOPSIS

```
#include <libaudit.h>
```

**int audit\_delete\_rule\_data(int** *fd***, struct audit\_rule\_data \****rule***, int** *flags***, int** *action***);"**

## DESCRIPTION

audit\_delete\_rule\_data is used to delete rules that are currently loaded in the kernel. The file descriptor is given in *fd* and the rule description in *rule*. To delete a rule, you must set up the rules identical to the one being deleted. See audit\_add\_rule\_data for *flags* and *action* definitions.

## RETURN VALUE

The return value is \<= 0 on error, otherwise it is the netlink sequence id number. This function can have any error that sendto would encounter.

## SEE ALSO

[**audit\_add\_rule\_data**(3)](/audit_add_rule_data/3.md), [**auditctl**(8)](/auditctl/8.md).

## AUTHOR

Steve Grubb