---
name: "audit_set_pid"
section: "3"
platform: "linux"
package: "audit"
version: "4.2.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/audit_set_pid"
---

# audit\_set\_pid(3)

Set audit daemon process ID

## NAME

audit\_set\_pid - Set audit daemon process ID

## SYNOPSIS

```
#include <libaudit.h>
```

**int audit\_set\_pid(int** *fd***, uint32\_t** *pid***, rep\_wait\_t** *wmode***);"**

## DESCRIPTION

audit\_set\_pid tells the kernel what the pid is of the audit daemon. The *fd* argument is an open descriptor to the audit netlink socket. When *pid* is set to 0, the kernel will log all events to syslog. Otherwise it will try to send events to the netlink connection that has the same *pid* given by this function. If for some reason the process goes away, the kernel will automatically set the value to 0 itself. Usually this function is called by the audit daemon and not an external program. If *wmode* is WAIT\_YES, the function will wait for an ACK from the kernel.

## RETURN VALUE

The return value is \<= 0 on error, otherwise it is the netlink sequence id number. This function can have any error that sendto would encounter.

## SEE ALSO

[**audit\_open**(3)](/audit_open/3.md), [**auditd**(8)](/auditd/8.md).

## AUTHOR

Steve Grubb