---
name: "audit_syscall_exit"
section: "9"
platform: "linux"
package: "linux-manual-3.2"
version: "3.2.78-1"
release: "Debian 7 (Wheezy)"
platforms: ["linux"]
url: "https://new.carta.tech/audit_syscall_exit"
---

# audit\_syscall\_exit(9)

deallocate audit context after a system call

## NAME

audit\_syscall\_exit - deallocate audit context after a system call

## SYNOPSIS

**void audit\_syscall\_exit(int** *valid***, long** *return\_code***);**

## ARGUMENTS

*valid*

success/failure flag

*return\_code*

syscall return value

## DESCRIPTION

Tear down after system call. If the audit context has been marked as auditable (either because of the AUDIT\_RECORD\_CONTEXT state from filtering, or because some other part of the kernel write an audit message), then write out the syscall information. In call cases, free the names stored from **getname**.

## COPYRIGHT