---
name: "audit_get_reply"
section: "3"
platform: "linux"
package: "audit"
version: "4.2.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/audit_get_reply"
---

# audit\_get\_reply(3)

Get the audit system's reply

## NAME

audit\_get\_reply - Get the audit system's reply

## SYNOPSIS

```
#include <libaudit.h>
```

**int audit\_get\_reply(int** *fd***, struct audit\_reply \****rep***, reply\_t** *block***, int** *peek***);"**

## DESCRIPTION

This function gets the next data packet sent on the audit netlink socket. This function is usually called after sending a command to the audit system. *fd* should be an open file descriptor returned by audit\_open. *rep* should be a data structure to put the reply in. *block* is of type reply\_t which is either: GET\_REPLY\_BLOCKING and GET\_REPLY\_NONBLOCKING. *peek*, if non-zero, gets the data without dequeueing it from the netlink socket.

## RETURN VALUE

This function returns -errno on error, 0 if error response received, and positive value on success.

## SEE ALSO

[**audit\_open**(3)](/audit_open/3.md).

## AUTHOR

Steve Grubb