---
name: "audit_log_start"
section: "9"
platform: "linux"
package: "linux-manual-4.9"
version: "4.9.228-1"
release: "Debian 9 (Stretch)"
platforms: ["linux"]
url: "https://new.carta.tech/audit_log_start"
---

# audit\_log\_start(9)

obtain an audit buffer

## NAME

audit\_log\_start - obtain an audit buffer

## SYNOPSIS

**struct audit\_buffer \* audit\_log\_start(struct audit\_context \*** *ctx***, gfp\_t** *gfp\_mask***, int** *type***);**

## ARGUMENTS

*ctx*

audit\_context (may be NULL)

*gfp\_mask*

type of allocation

*type*

audit message type

## DESCRIPTION

Returns audit\_buffer pointer on success or NULL on error.

Obtain an audit buffer. This routine does locking to obtain the audit buffer, but then no locking is required for calls to audit\_log\_\*format. If the task (ctx) is a task that is currently in a syscall, then the syscall is marked as auditable and an audit record will be written at syscall exit. If there is no associated task, then task context (ctx) should be NULL.

## COPYRIGHT