---
name: "audit_log_end"
section: "9"
platform: "linux"
package: "linux-manual-4.9"
version: "4.9.228-1"
release: "Debian 9 (Stretch)"
platforms: ["linux"]
url: "https://new.carta.tech/audit_log_end"
---

# audit\_log\_end(9)

end one audit record

## NAME

audit\_log\_end - end one audit record

## SYNOPSIS

**void audit\_log\_end(struct audit\_buffer \*** *ab***);**

## ARGUMENTS

*ab*

the audit\_buffer

## DESCRIPTION

**netlink\_unicast** cannot be called inside an irq context because it blocks (last arg, flags, is not set to MSG\_DONTWAIT), so the audit buffer is placed on a queue and a tasklet is scheduled to remove them from the queue outside the irq context. May be called in any context.

## COPYRIGHT