'\" t
.\"     Title: audit_log_start
.\"    Author: [FIXME: author] [see http://docbook.sf.net/el/author]
.\" Generator: DocBook XSL Stylesheets v1.79.1 <http://docbook.sf.net/>
.\"      Date: January 2017
.\"    Manual: Audit Interfaces
.\"    Source: Kernel Hackers Manual 4.8.15
.\"  Language: English
.\"
.TH "AUDIT_LOG_START" "9" "January 2017" "Kernel Hackers Manual 4\&.8\&." "Audit Interfaces"
.\" -----------------------------------------------------------------
.\" * Define some portability stuff
.\" -----------------------------------------------------------------
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.\" http://bugs.debian.org/507673
.\" http://lists.gnu.org/archive/html/groff/2009-02/msg00013.html
.\" ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
.ie \n(.g .ds Aq \(aq
.el       .ds Aq '
.\" -----------------------------------------------------------------
.\" * set default formatting
.\" -----------------------------------------------------------------
.\" disable hyphenation
.nh
.\" disable justification (adjust text to left margin only)
.ad l
.\" -----------------------------------------------------------------
.\" * MAIN CONTENT STARTS HERE *
.\" -----------------------------------------------------------------
.SH "NAME"
audit_log_start \- obtain an audit buffer
.SH "SYNOPSIS"
.HP \w'struct\ audit_buffer\ *\ audit_log_start('u
.BI "struct audit_buffer * audit_log_start(struct\ audit_context\ *\ " "ctx" ", gfp_t\ " "gfp_mask" ", int\ " "type" ");"
.SH "ARGUMENTS"
.PP
\fIctx\fR
.RS 4
audit_context (may be NULL)
.RE
.PP
\fIgfp_mask\fR
.RS 4
type of allocation
.RE
.PP
\fItype\fR
.RS 4
audit message type
.RE
.SH "DESCRIPTION"
.PP
Returns audit_buffer pointer on success or NULL on error\&.
.PP
Obtain an audit buffer\&. This routine does locking to obtain the audit buffer, but then no locking is required for calls to audit_log_*format\&. If the task (ctx) is a task that is currently in a syscall, then the syscall is marked as auditable and an audit record will be written at syscall exit\&. If there is no associated task, then task context (ctx) should be NULL\&.
.SH "COPYRIGHT"
.br