---
name: "audit_get_features"
section: "3"
platform: "linux"
package: "audit"
version: "4.2.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/audit_get_features"
---

# audit\_get\_features(3)

query or change kernel audit features

## NAME

audit\_get\_features, audit\_set\_feature - query or change kernel audit features

## SYNOPSIS

**#include \<libaudit.h\>**

**uint32\_t audit\_get\_features(void);**\
 **int audit\_set\_feature(int** *fd***, unsigned** *feature***, unsigned** *value***, unsigned** *lock***);"**

## DESCRIPTION

**audit\_get\_features**() returns a bitmap describing which kernel audit features are supported.  The bitmap is cached internally and retrieved from the kernel on the first call.

**audit\_set\_feature**() changes a feature bit for the kernel using the descriptor *fd* which must be an open audit netlink socket. *feature* selects the bit to modify.  If *value* is nonzero the feature is enabled, otherwise it is disabled.  If *lock* is nonzero the feature setting is locked until reboot.

The feature bits currently defined are:

- **AUDIT\_FEATURE\_BITMAP\_BACKLOG\_LIMIT**

  Kernel supports changing the backlog queue depth.

- **AUDIT\_FEATURE\_BITMAP\_BACKLOG\_WAIT\_TIME**

  Kernel supports delaying syscalls when the queue is full.

- **AUDIT\_FEATURE\_BITMAP\_EXECUTABLE\_PATH**

  Kernel will include the executable path on EXECVE records.

- **AUDIT\_FEATURE\_BITMAP\_EXCLUDE\_EXTEND**

  Exclude rules may be used with more fields than just message type.

- **AUDIT\_FEATURE\_BITMAP\_SESSIONID\_FILTER**

  Session identifier filtering is supported.

- **AUDIT\_FEATURE\_BITMAP\_LOST\_RESET**

  Allows resetting the lost event counter.

- **AUDIT\_FEATURE\_BITMAP\_FILTER\_FS**

  Kernel supports file system field filtering.

## RETURN VALUE

**audit\_get\_features** returns the feature bitmap or 0 if feature queries are unsupported.   **audit\_set\_feature** returns \<= 0 on error, otherwise it is the netlink sequence id number.

## SEE ALSO

[**audit\_request\_features**(3)](/audit_request_features/3.md), [**audit\_reset\_lost**(3)](/audit_reset_lost/3.md), [**audit\_open**(3)](/audit_open/3.md).

## AUTHOR

Steve Grubb