---
name: "libaudit.conf"
section: "5"
platform: "linux"
package: "audit"
version: "4.2.1-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/libaudit.conf"
---

# libaudit.conf(5)

libaudit configuration file

## NAME

libaudit.conf - libaudit configuration file

## DESCRIPTION

The file */etc/libaudit.conf* contains configuration information for user space applications that link to libaudit. The applications are responsible for querying the settings in this file and obeying the admin's preferences. This file contains one configuration keyword per line, an equal sign, and then followed by appropriate configuration information. The keywords recognized are: *failure\_action*. These keywords are described below.

- *failure\_action*

  This keyword specifies what action the admin wishes a user space application to take when there is a failure to send an audit event to the kernel. The possible values are:  *IGNORE*\
    \- meaning do nothing, *LOG* - write to syslog the inability to send an audit event, and *TERMINATE* - the user space application should exit.

## SEE ALSO

[**get\_auditfail\_action**(3)](/get_auditfail_action/3.md).

## AUTHOR

Steve Grubb