Could anyone point me to a source for comprehensive documentation for the Linux audit framework? I want to know how the framework interacts with the kernel to retrieve log information.

Thanks.