GET_AUDITFAIL_ACTION(3) get_auditfail_action - failure_action #include int get_auditfail_action(auditfail_t *failmode); failure_action /etc/libaudit.conf. get_auditfail_action audit_open . failure_action /etc/libaudit.conf failmode . . get_auditfail_action failmode failure_action. failure_action : FAIL_IGNORE (0) FAIL_LOG (1) FAIL_TERMINATE (2). get_auditfail_action . /etc/libaudit.conf failure_action . /* Sample code */ auditfail_t failmode; if ((fd = audit_open() ) < 0 ) { fprintf (stderr, "Cannot open netlink audit socket"); /* Get the failure_action */ if ((rc = get_auditfail_action(&failmode)) == 0) { if (failmode == FAIL_LOG) fprintf (stderr, "Audit subsystem unavailable"); else if (failmode == FAIL_TERMINATE) exit (1); /* If failmode == FAIL_IGNORE, do nothing */ } } audit_open(3) auditd(8). . . 3 . . : . 2.7 2006-7-10 GET_AUDITFAIL_ACTION(3)