---
name: "get_auditfail_action"
section: "3"
platform: "linux"
package: "audit"
version: "4.2.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/get_auditfail_action"
---

# get\_auditfail\_action(3)

Get failure\_action tunable value

## NAME

get\_auditfail\_action - Get failure\_action tunable value

## SYNOPSIS

```
#include <libaudit.h>
```

**int get\_auditfail\_action(auditfail\_t \****failmode***);**

## DESCRIPTION

This function gets the failure\_action tunable value stored in **/etc/libaudit.conf**. **get\_auditfail\_action** should be called after an **audit\_open** call returns an error to see what action the admin prefers.

The failure\_action value found in **/etc/libaudit.conf** is copied into the *failmode* argument upon function return.  This value should then be used by the calling application to determine what action should be taken when the audit subsystem is unavailable.

## RETURN VALUE

Upon success, **get\_auditfail\_action** returns a zero, and the *failmode* argument will hold the failure\_action value.  The possible values for failure\_action are: FAIL\_IGNORE (0), FAIL\_LOG (1), and FAIL\_TERMINATE (2). Upon failure, **get\_auditfail\_action** returns a return code of one.

## ERRORS

An error is returned if there is an error reading **/etc/libaudit.conf** or if the failure\_action tunable is not found in the file.

## EXAMPLES

       /\* Sample code \*/\
        auditfail\_t failmode;

       if ((fd = audit\_open() ) \< 0 ) {\
             fprintf (stderr, "Cannot open netlink audit socket");

            /\* Get the failure\_action \*/\
             if ((rc = get\_auditfail\_action(&failmode)) == 0) {\
                 if (failmode == FAIL\_LOG)\
                      fprintf (stderr, "Audit subsystem unavailable");\
                 else if (failmode == FAIL\_TERMINATE)\
                      exit (1);\
                 /\* If failmode == FAIL\_IGNORE, do nothing \*/\
             }\
        }

## SEE ALSO

[**audit\_open**(3)](/audit_open/3.md), [**auditd**(8)](/auditd/8.md).

## AUTHOR

Lisa M. Smith.