On Tuesday, September 3, 2019 5:15:29 PM EDT Ankitha Kundhuru wrote: > Any help is greatly appreciated. > > My piece of code can read audit.log file and process it.But when I enable > good number of syscalls, disk gets filled really quick (15GB for half a day > usage) > I wanted to know if there is a way to directly get the events from > userspace audit daemon instead of writing it to a file. Plan is that my > application should process the events as soon as they are created. Yes, there is a presentation that describes the architecture of the audit system including the realtime event interface: http://people.redhat.com/sgrubb/audit/audit_ids_2011.pdf And there is sample code for a plugin here: https://github.com/linux-audit/audit-userspace/tree/master/contrib/plugin -Steve